Ask your software vendors or developers whether their products use libcurl with the Schannel backend and automatic client certificate verification enabled.
If you don't know, treat any Windows application that makes outbound HTTPS requests via curl/libcurl as potentially affected.
Check with curl/your vendor for a patched release — none is available yet, so ask for an expected fix date.
In the meantime, avoid relying on automatic client certificate selection for sensitive connections if your software allows disabling it.
Re-check for an official curl patch regularly and apply it as soon as one is released.
libcurl's connection cache match function never considers the automatic client
certificate option, so a cached, already authenticated Schannel connection can
be handed to a transfer that got redirected to a different origin, even though
the code explicitly switched off the auto client cert option for that transfer
to prevent exactly this.
In plain language
Written by AI from the record
This is a flaw in curl, a tool many apps and devices use to make internet connections, that can let a malicious website trick a program into reusing trust meant for a different, safer site — no fix is available yet, so businesses using curl-based software should pay attention now.
CVE-2026-86415 is a connection-reuse logic flaw in libcurl's Schannel backend where the connection cache fails to check the automatic client-certificate setting, letting a transfer redirected to Origin B inherit an authenticated connection and trust context established for Origin A.
If you're affected
Bypassed certificate trust checks
Unauthorized access via redirect trickery
Credential/trust leakage across sites
Risk in any app embedding curl
What is it
Think of curl as the delivery driver many apps use to fetch information from the internet securely, using a special ID badge (a client certificate) to prove trust with a specific building. This bug can let the driver get rerouted to a different, untrusted building and still show the first building's ID badge, letting that untrusted site piggyback on trust it was never supposed to have.
Who is affected
This matters to you if any software, app, or device your business uses is built on libcurl and runs on Windows using its built-in Schannel security library with automatic client certificate authentication turned on. It is relevant to developers, IT teams managing custom or embedded software, and vendors whose products silently bundle curl. This is only a risk if a user's connection gets redirected to a different site that disabled the automatic client certificate option for safety reasons.
How urgent is it
This is reachable by default in affected configurations and requires no login — just a normal redirect during a web request — making it easy for a malicious server or network attacker to trigger. There is no confirmed active exploitation yet and no public exploit code, but there is also no patch available at all, meaning every day it remains unfixed is a day affected software stays exposed with no remediation path. Treat this as urgent: track for a fix closely and don't wait for exploitation reports before acting.
What to do — in detail
Inventory which internal or third-party applications link against libcurl using the Schannel TLS backend on Windows, particularly ones using the automatic client certificate option. 2. Reach out to the curl project and any vendors bundling curl to confirm patch status — as of now, no fixed version has been published, so ask for a tracking issue or CVE advisory update. 3. As a temporary mitigation, disable automatic client certificate selection where your application configuration allows it, or disable connection reuse/caching for multi-origin redirect scenarios if your framework exposes that control. 4. Once a patched curl release is published, prioritize upgrading any Windows-based software using Schannel and automatic client cert auth, testing redirect-heavy workflows afterward since connection cache behavior may change. 5. Monitor the curl security advisories page and this CVE entry for the official fixed version and CISA KEV status, since none is currently listed.
Technical context
Weakness: improper connection reuse/cache validation (CWE-ish: insufficient verification of connection attributes before reuse) in libcurl's Schannel TLS backend. Attack vector is network-based, requires no authentication, but does require the victim application to process a server-controlled redirect to trigger reuse of a cached, authenticated connection. No KEV listing, no public exploit code, and no dated press claims of in-the-wild exploitation exist; EPSS places predicted exploitation likelihood very low with a flat trend, consistent with no observed activity. However, no patch or fixed version has been released at this time, so there is no remediation available beyond configuration-level mitigations or vendor engagement.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
