An ftp:// transfer configured with CURLUSESSL_NONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and… (CVE-2026-86411)

CVE-2026-86411 describes a flaw where an ftp:// transfer using CURLUSESSL_NONE can reuse an existing pooled FTP control connection that was upgraded with STARTTLS and authenticated via a client certificate by a prior easy handle. Because the second handle skips a new TLS handshake and FTP login, the server mistakenly authorizes it under the first handle's client certificate identity, potentially allowing unauthorized access or actions under that identity.

The vulnerability may allow an FTP client to reuse an authenticated and encrypted control connection without re-authenticating, potentially leading to unauthorized actions performed under the identity of the first authenticated session. This could result in unintended access or privilege escalation on the FTP server if multiple FTP handles are used in the same client environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid reusing pooled FTP control connections configured with CURLUSESSL_NONE in contexts where STARTTLS and client certificate authentication are used. Explicitly closing connections or disabling connection pooling may reduce risk.