# CVE-2026-13608: libcurl SASL negotiation authentication bypass in LDAP

Source: https://junglewise.ai/threats/cve-2026-13608-libcurl-sasl-negotiation-authentication-bypass-in-ldap  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-13608 · Severity: high · CVSS 7.4 · Published 2026-09-06

libcurl is a widely-used networking library that handles secure communication, including LDAP directory authentication. This flaw allows attackers performing a man-in-the-middle attack to trick the LDAP authentication process into accepting an incomplete handshake as successful, bypassing peer validation and potentially gaining unauthorized access to LDAP-protected resources.

Technologies: [Haxx Curl](https://junglewise.ai/threats/technologies/curl). Vendors: [Haxx](https://junglewise.ai/threats/vendors/haxx).

## Quick answers

**Is CVE-2026-13608 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13608 being exploited in the wild.

**How severe is CVE-2026-13608?** High severity, with a CVSS score of 7.4, published 6 September 2026.

**Which products and versions are affected?** curl curl 7.82.0 to 8.21.0 (across multiple release branches; see advisory for affected version ranges).

**Is there a fix for CVE-2026-13608?** A patch was published on 2026-09-02: curl 8.22.0 released with fix, coordinated with advisory publication Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13608 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-13608?** Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A flaw in the libcurl SASL negotiation mechanism for LDAP authentication (CWE-923: Improper Restriction of Communication Channel) allows an incomplete handshake sequence to be misinterpreted as successful cryptographic verification. An attacker performing a man-in-the-middle attack can inject a premature or shortcut response to bypass complete peer validation. The vulnerability only affects unencrypted LDAP:// connections using the OpenLDAP backend; LDAPS:// (LDAP over TLS) is not vulnerable as server certificate validation already prevents impostor attacks. The flaw was introduced in version 7.82.0 and fixed in versions 8.14.2, 8.16.1, 8.20.1, and 8.22.0 respectively across affected release branches.

## Affected products

- curl curl 7.82.0 to 8.21.0 (across multiple release branches; see advisory for affected version ranges)

## Timeline

- 2026-06-24: disclosed: Vulnerability reported to curl project
- 2026-09-02: patched: curl 8.22.0 released with fix, coordinated with advisory publication
- 2026-09-02: advisory: Security advisory published

## References

- [https://curl.se/docs/CVE-2026-13608.html](https://curl.se/docs/CVE-2026-13608.html)
- [https://curl.se/docs/CVE-2026-13608.json](https://curl.se/docs/CVE-2026-13608.json)

## Related threats

- [curl Public Suffix List domain boundary check bypass in cookie handling](https://junglewise.ai/threats/cve-2026-82209-curl-public-suffix-list-domain-boundary-check-bypass-in-cookie)
- [curl libcurl certificate validation bypass in wolfSSL backend](https://junglewise.ai/threats/cve-2026-82208-curl-libcurl-certificate-validation-bypass-in-wolfssl-backend)
- [curl secure cookie attribute bypass with tab](https://junglewise.ai/threats/cve-2026-80255-curl-secure-cookie-attribute-bypass-with-tab)
- [curl HTTPS connection reuse with mismatched CA store settings](https://junglewise.ai/threats/cve-2026-80231-curl-https-connection-reuse-with-mismatched-ca-store-settings)
- [curl public key pinning bypass with disabled peer verification](https://junglewise.ai/threats/cve-2026-80230-curl-public-key-pinning-bypass-with-disabled-peer-verification)