libcurl maintains a pool of recent connections to optimize network requests by reusing existing connections when possible. However, a logical error in the connection reuse criteria can cause a request to reuse a connection authenticated with a different Negotiate service than intended. This flaw may lead to unintended reuse of authenticated connections across different services, potentially violating authentication boundaries. The vulnerability is identified as CVE-2026-8458. No CVSS score or detailed impact metrics are provided, and no patch or remediation information is available in the provided data.

The vulnerability may allow a request to reuse an existing connection authenticated for a different service, potentially causing authentication context confusion. This could lead to unintended access or information disclosure if the reused connection grants privileges or access not intended for the current request. However, no specific exploitation details or known active exploits are reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when using Negotiate authentication with libcurl and consider disabling connection reuse for such requests if feasible.