# CVE-2026-80230: curl public key pinning bypass with disabled peer verification

Source: https://junglewise.ai/threats/cve-2026-80230-curl-public-key-pinning-bypass-with-disabled-peer-verification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-80230 · Severity: high · CVSS 7.5 · Published 2026-09-06

curl is a widely-used library and command-line tool for transferring data over the network. Public key pinning is a security mechanism used to prevent man-in-the-middle attacks by validating that a server's certificate matches a pre-configured list. This vulnerability allows an attacker to bypass that pinning check when certificate verification is disabled, enabling unauthenticated connections that should be rejected.

Technologies: [Haxx Curl](https://junglewise.ai/threats/technologies/curl). Vendors: [Haxx](https://junglewise.ai/threats/vendors/haxx).

## Quick answers

**Is CVE-2026-80230 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80230 being exploited in the wild.

**How severe is CVE-2026-80230?** High severity, with a CVSS score of 7.5, published 6 September 2026.

**Which products and versions are affected?** curl curl 7.45.0 to 8.21.0.

**Is there a fix for CVE-2026-80230?** A patch was published on 2026-09-02: curl 8.22.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-80230 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-80230?** Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an improper certificate validation vulnerability (CWE-295) in curl's public key pinning implementation. When CURLOPT_PINNEDPUBLICKEY is set in combination with CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0, libcurl fails to enforce the pinning check on connections where the server does not present a certificate. An unauthenticated attacker with network access can exploit this by establishing a connection without presenting a valid certificate, bypassing the pinning mechanism that should reject such connections. The vulnerability affects versions 7.45.0 through 8.21.0 when built against OpenSSL or its forks (BoringSSL, AWS-LC, LibreSSL, QuicTLS). Patches are available in curl 8.22.0, 8.20.1, 8.16.1, and 8.14.2 or later.

## Affected products

- curl curl 7.45.0 to 8.21.0

## Timeline

- 2026-09-02: disclosed
- 2026-09-02: patched: curl 8.22.0 released with fix

## References

- [https://curl.se/docs/CVE-2026-80230.html](https://curl.se/docs/CVE-2026-80230.html)
- [https://curl.se/docs/CVE-2026-80230.json](https://curl.se/docs/CVE-2026-80230.json)

## Related threats

- [curl Public Suffix List domain boundary check bypass in cookie handling](https://junglewise.ai/threats/cve-2026-82209-curl-public-suffix-list-domain-boundary-check-bypass-in-cookie)
- [curl libcurl certificate validation bypass in wolfSSL backend](https://junglewise.ai/threats/cve-2026-82208-curl-libcurl-certificate-validation-bypass-in-wolfssl-backend)
- [curl secure cookie attribute bypass with tab](https://junglewise.ai/threats/cve-2026-80255-curl-secure-cookie-attribute-bypass-with-tab)
- [curl HTTPS connection reuse with mismatched CA store settings](https://junglewise.ai/threats/cve-2026-80231-curl-https-connection-reuse-with-mismatched-ca-store-settings)
- [curl OpenSSL provider use-after-free in TLS connections](https://junglewise.ai/threats/cve-2026-80229-curl-openssl-provider-use-after-free-in-tls-connections)