libcurls connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Curl | Ubuntu | upstream | * |