Bug 2550604 (CVE-2026-86415)

Summary:	CVE-2026-86415 curl: curl: auto client cert connection reuse mixup
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anthomas, csutherl, ehelms, ggainey, jclere, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, pjindal, plodge, rchan, rekumar, rhel-process-autobot, security-response-team, smallamp, szappis, tmalecek, vchlup, vvoronko, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in curl. In builds configured with the Microsoft Schannel Transport Layer Security (TLS) backend, libcurl's connection cache fails to evaluate client certificate authentication settings when handling HTTP redirects. A malicious server can redirect a transfer to a different destination, causing curl to inappropriately reuse an already authenticated connection. This issue can result in information disclosure by exposing client certificates and credentials to unintended origins.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-13 15:00:19 UTC

auto client cert connection reuse mixup
=======================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-86415.html)

VULNERABILITY
-------------

libcurl's connection cache matcher never considers the automatic client
certficate option, so a cached, already authenticated Schannel connection can
be handed to a transfer that just got redirected to a different origin, even
though the code explicitly switched off the auto client cert option for that
transfer to prevent exactly this.

INFO
----

This flaw only affects curl builds using Schannel, which is a TLS backend only
available on Windows.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-86415 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.21.0 to and including 8.22.0
- Not affected versions: curl < 8.21.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/d69bfad3fa3daf5e72331f68

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/00271cfcb95b6481a1f91ce0a0dad

RECOMMENDATIONS
--------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Build curl with a different TLS backend

TIMELINE
--------

This issue was reported to the curl project on September 3, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Stefan Eissing

Thanks a lot!