CVE-2026-13608

Modified Modified - Updated After Analysis

Incomplete SASL LDAP Handshake Validation Bypass in libcurl

Publication date: 2026-09-06

Last updated on: 2026-09-15

Assigner: curl

Description

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-06

Last Modified

2026-09-15

Generated

2026-09-28

AI Q&A

2026-09-06

EPSS Evaluated

2026-09-27

NVD

CVE-2026-13608

EUVD

EUVD-2026-72164

Affected Vendors & Products

Vendor	Product	Version / Range
haxx	curl	From 7.82.0 (inc) to 8.22.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-923	The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Attack-Flow Graph

Executive Summary

CVE-2026-13608 is a flaw in libcurl's SASL negotiation for LDAP authentication. It allows an incomplete handshake to be misinterpreted as successful cryptographic verification. An attacker can perform a Man-in-the-Middle attack by injecting a premature response, bypassing peer validation and gaining unauthorized access.

Detection Guidance

To detect this vulnerability, check if your system is running a vulnerable version of curl (7.82.0 through 8.21.0). Use the command: curl --version. If the output shows a version within this range, the system is affected.

Impact Analysis

This vulnerability may allow attackers to bypass authentication and gain unauthorized access to systems using vulnerable curl versions with OpenLDAP SASL authentication. It specifically affects LDAP:// connections, not LDAPS:// (TLS-encrypted) connections. Attackers could intercept or manipulate data during authentication.

Compliance Impact

This vulnerability primarily affects systems using OpenLDAP backend with unencrypted LDAP:// connections. It allows MITM attacks to bypass peer validation, which could lead to unauthorized access to sensitive data. For GDPR, this may impact data confidentiality and integrity requirements. For HIPAA, it could compromise protected health information during transmission if LDAP is used for authentication in healthcare systems.

Mitigation Strategies

Upgrade curl to version 8.22.0 or later. If upgrading is not possible, avoid using unencrypted LDAP:// connections. Apply any available patches from your distribution or vendor.

Hi! I’m here to help you understand CVE-2026-13608. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70