CVE-2026-86411

A flaw was found in curl that can allow unauthorized access through improper session reuse. When an unencrypted File Transfer Protocol (FTP) transfer reuses a pooled connection previously authenticated with a client certificate and upgraded using Transport Layer Security (TLS), curl fails to perform a new handshake or authentication. As a result, the subsequent transfer operates under the prior session's identity, allowing it to perform operations on the remote server with unintended authorization.

This vulnerability is rated as Low impact by Red Hat because triggering it requires an uncommon sequence of operations where a client application shares a connection pool across both certificate-authenticated FTP sessions and unauthenticated cleartext transfers. In typical enterprise environments, FTP transfers utilizing client certificate authentication are exceptionally rare, substantially constraining real-world attack scenarios. Consequently, exploitation is confined to custom applications specifically designed to reuse connection caches across transfers with mismatched security postures.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.