libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel… (CVE-2026-86415)

The libcurl library has a flaw in its connection cache matching logic where it does not consider the automatic client certificate option. As a result, a Schannel connection that was previously authenticated and cached can be incorrectly reused for a transfer redirected to a different origin. This occurs despite the code explicitly disabling the automatic client certificate option for the redirected transfer, potentially leading to unintended reuse of client authentication credentials.

This vulnerability may lead to the reuse of an authenticated connection with client certificates in contexts where such reuse was explicitly disabled, potentially causing client authentication to be applied to unintended origins. The exact security impact depends on how libcurl is used and the sensitivity of the client certificate authentication in the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious with redirects involving client certificate authentication and consider disabling connection caching or avoiding automatic client certificate usage on redirected transfers.