AIKIDO-2026-889311

TL;DR

An incomplete fix for CVE-2026-48934 left HTTPS Agent TLS session and connection reuse able to skip per-request hostname verification. When a request supplies a custom checkServerIdentity callback that was not also configured on the Agent itself, the Agent can still reuse a prior TLS session or keep-alive socket keyed only by host, so the custom identity check is never applied to the reused connection. An attacker who can redirect traffic after a session was established under a different identity policy may therefore bypass intended certificate hostname checks. The fix excludes per-request checkServerIdentity from session and connection reuse unless that option was set when constructing the Agent.