---
id: CVE-2026-86411
title: FTP connection reuse inherits client-certificate
summary: |-
  An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP
  control connection that a previous easy handle upgraded with `STARTTLS` and
  authenticated using a client certificate. The second handle performs neither a
  new …
severity: none
cwe:
  - CWE-488
vendor: curl
product: curl
affected:
  - curl >= 8.21.0 <= 8.21.0
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T20:02:03.431Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-86411'
references:
  - url: 'https://curl.se/docs/CVE-2026-86411.json'
    label: json
  - url: 'https://curl.se/docs/CVE-2026-86411.html'
    label: www
  - url: 'https://hackerone.com/reports/3973190'
    label: issue
tags:
  - cve.org
ingestedAt: '2026-10-20T20:18:14.526Z'
---

## Overview

An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP
control connection that a previous easy handle upgraded with `STARTTLS` and
authenticated using a client certificate. The second handle performs neither a
new TLS handshake nor a new FTP login, so the server continues to authorize it
under the first handle's certificate identity.

## Affected

- `curl >= 8.21.0 <= 8.21.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.