CVE-2026-86411

Received Received - Intake

FTP Control Connection Reuse with Client Certificate in cURL

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: curl

Description

An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to authorize it under the first handle's certificate identity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-86411

EUVD

EUVD-2026-105276

Affected Vendors & Products

Vendor	Product	Version / Range
curl	curl	8.21.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

CVE-2026-86411 is a vulnerability in curl where an FTP transfer configured without SSL (CURLUSESSL_NONE) can reuse a pooled FTP control connection that was previously upgraded with STARTTLS and authenticated using a client certificate. The second connection does not perform a new TLS handshake or FTP login, so the server continues to authorize it under the first connection's certificate identity.

Detection Guidance

To detect this vulnerability, check if your system uses curl versions 8.21.0 or earlier. Run 'curl --version' to verify the installed version. If it is 8.21.0 or older, the system is vulnerable. Additionally, inspect FTP connections for reused control connections without new TLS handshakes or FTP logins.

Impact Analysis

This vulnerability could allow unauthorized access to FTP servers if an attacker reuses a pooled connection with a client certificate. It may lead to data exposure or privilege escalation if the server relies on certificate-based authentication.

Mitigation Strategies

Upgrade curl to version 8.22.0 or later. If upgrading is not possible, avoid using client certificates for FTP transfers. Apply the official patch from curl's repository if available.

Hi! I’m here to help you understand CVE-2026-86411. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70