CVE-2026-80230

Executive Summary

CVE-2026-80230 is a certificate-validation defect in libcurl (Haxx/curl) in which public key pinning (CURLOPT_PINNEDPUBLICKEY) is silently not enforced when the caller has also disabled standard peer verification (CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0). Under these conditions a connection carrying no presented server certificate can complete successfully instead of being rejected. Applications, appliances, and CI/CD agents that rely on libcurl for TLS transport while pinning a public key — but which also ship the disabled-verification flags — lose the only remaining authentication control and can be redirected to attacker-controlled endpoints; the CVSS vector scores this as a network-reachable, no-privilege, no-interaction availability impact of High (7.5).

Technical Analysis

libcurl's CURLOPT_PINNEDPUBLICKEY is a public-key (certificate) pinning control. It is intended to constrain which end-entity certificate a client will accept for a given host, independent of the CA trust chain. It is normally used in the same configuration set as standard peer verification, adding defense-in-depth on top of CA validation.

CWE-295 (Improper Certificate Validation) is the assigned class. The NVD description states that when CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification — specifically CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0 — "libcurl fails to enforce public key pinning on connections established without a presented server certificate." The stated consequence is that "bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected."

The critical technical point is the interaction between two independent validation layers:

1. Chain validation — normally governed by CURLOPT_SSL_VERIFYPEER (verify the peer's certificate against the trust store) and CURLOPT_SSL_VERIFYHOST (verify the hostname in the certificate matches the requested host). Setting either to 0 disables the corresponding check.
2. Public key pinning — governed by CURLOPT_PINNEDPUBLICKEY. This check is supposed to remain a hard gate even when chain validation is relaxed.

The defect is that the pinning gate is skipped in a code path where no server certificate is presented at all. Because verification was disabled, no certificate-based identity exists for the pinning logic to compare against, and the connection is permitted to proceed as "unauthenticated." The TLS session therefore establishes without the pin being satisfied.

It is important to be precise about what is and is not established by the available data. The NVD description does not name internal functions, files, or the exact TLS handshake stage at which the check is dropped, so no implementation-level identifiers are asserted here. There is no CNA title, no affected-version list, and no OSV package metadata in the provided intelligence, which means the precise release range in which the behavior exists cannot be stated as fact. What can be stated is the vulnerability class (improper certificate validation), the trigger condition (pinning plus disabled peer verification), and the outcome (unauthenticated connections succeed). The attack surface is any network path where a libcurl-based client connects outward with this option combination — the attacker needs to be able to answer the connection, not to reach a listening service on the victim.

Exploitation Scenarios

No public PoC is confirmed in the supplied data (POC_STATUS is flagged Public but no exploit code or Nuclei template is listed), so the attack chain below is inferred strictly from the vulnerability class described in the NVD text. No internal function names, file paths, or code patterns are invented.

1. Reconnaissance / target identification. The adversary identifies an application, agent, or appliance that uses libcurl for outbound TLS and that pins a public key (CURLOPT_PINNEDPUBLICKEY) while also carrying the disabled-verification flags. These two settings in combination are a distinctive configuration signature; targets are typically embedded clients, updaters, telemetry agents, or internal tooling where developers disabled verification as a shortcut and added pinning "on top."

2. Triggering the flaw class. The attacker positions themselves on the network path — DNS control, leaked/spoofed resolution, ARP/route manipulation, or a compromised upstream endpoint — so that the client's connection is answered by an attacker-controlled service instead of the legitimate one. Because CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0 are set, the client will not validate the chain or hostname. The attacker's service presents no certificate (or a self-signed/absent one). Per the description, the pinning check is not enforced for connections established without a presented server certificate, so the connection is accepted and the TLS session is established to the attacker.

3. Execution / interaction. With the session established, the attacker-supplied server responds to the client over the now-unauthenticated channel. The content delivered depends on what the client was fetching — API responses, update manifests, configuration data, telemetry responses — and is returned as if from the trusted peer. No credential or user interaction is required, consistent with PR:N and UI:N in the CVSS vector.

4. Post-exploitation impact. The impact is authentication bypass of the pin: an endpoint that was supposed to be cryptographically constrained can be impersonated. Downstream effects include man-in-the-middle content substitution, data exfiltration via crafted responses, or feeding malformed responses that crash the client — consistent with the scored C:N/I:N/A:H, where the only modeled impact is availability. In practice, integrity and confidentiality effects depend entirely on what the calling application does with the response stream and are therefore organization-specific.

The exploitation precondition is decisive: an affected build must actually be configured with both the pin and the disabled-verification flags. That combination is intentionally self-contradictory, which limits the realistic blast radius to misconfigured or legacy deployments rather than every libcurl consumer.

Impact Assessment

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5 (High). Subscores translate to:

• AV:N (Network). Exploitable from the network path; the attacker answers outbound connections rather than touching a local socket.
• AC:L (Low). No special conditions beyond the misconfiguration.
• PR:N / UI:N. No credentials and no user action; the client does it autonomously.
• S:U (Unchanged). Impact stays within the vulnerable client's security authority.
• C:N / I:N. The scored model projects no direct confidentiality or integrity impact.
• A:H (High). The modeled impact is availability — an unauthenticated connection succeeding where it should be rejected can cause the caller to fail, hang, or abort work it depended on.

Blast radius. Any application, daemon, container image, or embedded device linked against an affected libcurl build and configured with this option pair. Because CURLOPT_PINNEDPUBLICKEY is a deliberate, manually-added hardening control, the affected population is likely small but skews toward security-sensitive consumers — packaging systems, update mechanisms, and regulated-industry tooling — which raises business impact per victim even as victim count stays low.

Business impact. The trust assumption being violated is explicit pinning, which is usually chosen precisely because the operator does not fully trust the CA ecosystem. Losing that control silently means an operator may believe a channel is pinned when it demonstrably is not, undermining compliance attestations (e.g., controls asserting certificate pinning) and supply-chain integrity claims for updates delivered by such clients.

Exploitability signal. EPSS is 0.00401 (33.6th percentile), indicating low predicted exploitation pressure in the near term. CISA KEV does not list this CVE. No public exploit code, Nuclei template, or confirmed in-the-wild campaign is present in the supplied data.

Detection Guidance

Detection must focus on the effect — a libcurl client completing a TLS connection to an unexpected or certificate-less peer while configured for pinning — since the vulnerability produces no distinctive server-side artifact by itself.

Sigma Rule

title: libcurl Client Proceeding Without Enforced Public Key Pinning
id: 6f2a1c44-8023-4f31-9d47-2c80230aa001
status: experimental
description: Detects process-level indicators that a libcurl-based client launched with disabled peer verification (CURLOPT_SSL_VERIFYPEER=0 / CURLOPT_SSL_VERIFYHOST=0) plus public key pinning, the configuration implicated in CVE-2026-80230.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-80230
author: valtersit.com threat intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.295
logsource:
  category: process_creation
  product: linux
detection:
  selection_env:
    CommandLine|contains:
      - 'CURLOPT_SSL_VERIFYPEER'
      - 'CURLOPT_SSL_VERIFYHOST'
      - 'CURLOPT_PINNEDPUBLICKEY'
  selection_cli:
    CommandLine|contains:
      - '--insecure'
      - '-k'
      - '--pinnedpubkey'
  condition: selection_cli
falsepositives:
  - Legitimate internal tooling that intentionally disables verification for lab hosts
  - Test suites invoking curl with --insecure
level: medium

YARA Rule

rule CVE_2026_80230_libcurl_pin_bypass_config
{
    meta:
        description = "Detects libcurl option-name strings coexisting in the same binary/script artifact, the configuration combination implicated in CVE-2026-80230"
        author = "valtersit.com threat intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-80230"
        date = "2026-01-01"
        cwe = "CWE-295"

    strings:
        $pin  = "CURLOPT_PINNEDPUBLICKEY" ascii
        $vp   = "CURLOPT_SSL_VERIFYPEER" ascii
        $vh   = "CURLOPT_SSL_VERIFYHOST" ascii
        $curl = "libcurl" ascii nocase

    condition:
        filesize < 50MB and
        $curl and
        $pin and
        ( $vp or $vh )
}

Note: this rule flags the vulnerable/misconfigured configuration signature, not a malware sample. Tune to your artifact inventory.

Suricata IDS Rule

alert tls $HOME_NET any -> $EXTERNAL_NET any ( \
  msg:"CVE-2026-80230 - Outbound TLS session to peer with no presented certificate from libcurl client"; \
  flow:established,to_server; \
  tls.handshake.type:1; \
  threshold:type limit, track by_src, count 1, seconds 60; \
  classtype:policy-violation; \
  reference:cve,2026-80230; \
  sid:8023001; rev:1; )

Elastic Detection

process where event.type == "start" and
  process.name in ("curl", "curl.exe", "libcurl") and
  process.args : ("--insecure", "-k", "--pinnedpubkey")

Splunk SPL Query

index=main (EventCode=1 OR sourcetype=sysmon OR sourcetype=linux_auditd)
  (process_name=curl OR process_name=libcurl*)
  (CommandLine="*--insecure*" OR CommandLine="*-k*" OR CommandLine="*--pinnedpubkey*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(CommandLine) as cmdlines by host, user, process_name
| where count > 0
| sort - last_seen

Wazuh OSSEC Rule

<group name="threat_intel,cve_2026_80230,">
  <rule id="802300" level="8">
    <decoded_as>json</decoded_as>
    <field name="process.name">^curl$|^curl\.exe$|^libcurl</field>
    <field name="process.args">--insecure|--pinnedpubkey</field>
    <description>CVE-2026-80230: curl client invoked with disabled verification or pinning options - review for pin enforcement gap</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_295,curl,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (NVD) asserts a patch exists; no vendor advisory, commit reference, release version, or independent confirmation was available in the supplied data. Do not rely on the patch status alone — validate against the upstream curl security advisory before closing remediation tickets.

1) Immediate mitigations (do not require a patch):

• Do not combine pinning with disabled verification. If CURLOPT_PINNEDPUBLICKEY is set, remove CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0. This is the exact trigger combination and its removal closes the bypass regardless of patch state.
• Inventory for the pattern. Search source and configuration for the co-occurrence of the pin option and the two disabled-verification options. Pay special attention to embedded devices, updaters, CI agents, and container base images.
• Compensate where the flags cannot be removed immediately by constraining egress (allow-list destination hosts/IPs) so an attacker cannot answer the connection, and by monitoring for connections that complete against peers presenting no certificate.

2) Patch / upgrade steps:

• Track the official curl/libcurl security advisory and release notes for the fixed version; the supplied data does not name one, so do not assume a specific release.
• Once a fixed version is published, rebuild or bump the bundled libcurl in all affected products — including statically linked binaries and vendored copies, which are commonly missed.
• For dynamically linked environments, upgrade the system libcurl package and restart dependent services.
• Re-test the pinning behavior explicitly after upgrade: run a pinned client against a peer that presents no certificate and confirm the connection is rejected.

3) Long-term hardening:

• Adopt a policy that pinning never coexists with disabled verification; enforce it in code review and linters.
• Treat certificate-pinning configuration as security-critical and gate it through configuration management with drift detection.
• Include libcurl version and TLS option configuration in SBOM/asset inventory so future curl advisories can be triaged by actual exposure rather than by library presence.
• Add regression tests that assert pinned clients reject certificate-less peers, so this class of defect is caught locally.

References

• NVD — CVE-2026-80230: https://nvd.nist.gov/vuln/detail/CVE-2026-80230
• CWE-295 — Improper Certificate Validation: https://cwe.mitre.org/data/definitions/295.html
• libcurl option reference — CURLOPT_PINNEDPUBLICKEY, CURLOPT_SSL_VERIFYPEER, CURLOPT_SSL_VERIFYHOST: https://curl.se/libcurl/c/ (see the option pages for the exact symbols cited in the NVD description)
• curl project security advisories: https://curl.se/docs/security.html
• FIRST EPSS — CVE-2026-80230 scoring (0.00401, 33.6th percentile): https://api.first.org/data/v1/epss?cve=CVE-2026-80230

Threat actor / exploitation status: No CISA KEV listing, no confirmed in-the-wild exploitation, and no named threat actor campaign is present in the supplied intelligence. Public PoC is flagged but no exploit code or Nuclei template is available. Monitoring for change in EPSS and KEV status is recommended, as the low current EPSS score reflects novelty rather than inherent exploitability — the technical barrier to exploitation is low once the required misconfiguration is present.