curl / Docs / curl CVEs / OpenLDAP SASL authentication bypass
Related:
Audits
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table

CVE-2026-13608

OpenLDAP SASL authentication bypass

Project curl Security Advisory, September 2 2026 Permalink

VULNERABILITY

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.

INFO

This flaw only exists when the OpenLDAP backend is used.

If LDAPS:// is used (LDAP done over TLS), this problem is never reached as impostors are then rejected already when validating the server certificate.

This bug is not considered a C mistake (likely to have been avoided had we not been using C).

This flaw also affects the curl command line tool.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-13608 to this issue.

CWE-923: Improper Restriction of Communication Channel to Intended Endpoints

Severity: Low

AFFECTED VERSIONS

SOLUTION

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl and libcurl to version 8.22.0

B - Apply the patch to your version and rebuild

C - Avoid using LDAP:// (without TLS)

TIMELINE

This issue was reported to the curl project on June 24, 2026.

curl 8.22.0 was released on September 2 2026, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!