CVE-2026-82208

Executive Summary

CVE-2026-82208 is a trust-store validation bypass vulnerability in libcurl when compiled with the wolfSSL backend. Under a specific configuration—where CA caching is enabled and an application registers an CURLOPT_SSL_CTX_FUNCTION callback to replace the default trust store—libcurl can silently revert to the previously cached CA store after the callback returns. This results in certificate validation against a stale store, allowing a certificate that the application explicitly rejected to be accepted as valid. The flaw impacts curl-based applications (e.g., API clients, automation tools, software update mechanisms) that rely on programmatic trust-store customization. Successful exploitation enables man-in-the-middle (MITM) attacks and credential theft against affected endpoints. No CVSS score, EPSS data, or public exploit code has been released at time of writing.

Technical Analysis

The vulnerability stems from an ordering flaw in libcurl's TLS session management when used with the wolfSSL backend. The affected code path is activated under two simultaneous preconditions:

1. CA caching enabled: libcurl caches the Certificate Authority (CA) bundle across multiple TLS handshakes to avoid redundant file I/O and parsing. This is an optimization feature that reduces per-connection overhead.

2. Custom trust-store callback: The application registers an CURLOPT_SSL_CTX_FUNCTION callback. This callback is designed to permit applications to modify the SSL context (via native OpenSSL-style APIs) before the handshake completes—commonly used to replace the trust store with an application-specific CA bundle, pin certificates, or apply enterprise PKI policies.

The flaw occurs in the interaction between these two features. During handshake initialization, libcurl loads the cached CA store into the SSL context. It then invokes the CURLOPT_SSL_CTX_FUNCTION callback, allowing the application to overwrite the trust store with a custom selection (e.g., calling a wolfSSL API function such as wolfSSL_CTX_load_verify_locations or wolfSSL_CTX_set_default_verify_paths). However, due to a race condition or a logic error in state management within the wolfSSL integration layer, libcurl re-installs the previously cached store after the callback returns, thereby discarding the application's trust-store replacement. The certificate validation that follows uses the stale cached store rather than the callback-selected store.

The security consequence is that a certificate signed by a CA present in the cached store—but deliberately excluded by the application's callback-defined store—passes validation. This is a direct bypass of the application's explicit security policy. The flaw is specific to the wolfSSL backend; other TLS backends (OpenSSL, GnuTLS, mbedTLS, Schannel, etc.) are unaffected because their integration code does not exhibit this reinstallation behavior. The vulnerability class is CWE-295 (Improper Certificate Validation), though the precise implementation flaw may be more accurately described as a "state restoration error" or "logic error in resource handling."

No source-level details were provided in the NVD description beyond the two named functions. The attack surface is any application using curl's multi/easy interface with both features enabled. No CVE-affecting version range was disclosed; the Debian security tracker indicates a patch is available but specific package versions were not enumerated.

Exploitation Scenarios

No public proof-of-concept exists at time of writing. The following attack chain is inferred strictly from the vulnerability class and configuration preconditions described in the NVD entry.

Step 1 — Reconnaissance/Target Identification: An attacker identifies a target application that (a) uses libcurl with the wolfSSL backend and (b) employs CURLOPT_SSL_CTX_FUNCTION to implement certificate pinning or a custom enterprise CA policy. This is common in embedded devices, IoT gateways, and financial mobile-backend APIs that ship with custom root stores. The attacker would fingerprint the application by observing TLS handshakes or via public documentation referencing curl + wolfSSL. Alternatively, an attacker inside the network path (e.g., on the same LAN or with ARP-spoofing access) can position themselves to intercept traffic passively.

Step 2 — Triggering the Flaw: The attacker initiates a TLS connection to the target application's outbound HTTPS request. To exploit the bug, the attacker must present a certificate that is (i) signed by a CA in the cached store but (ii) not in the callback-selected store. The callback's trust-store replacement is silently undone by the vulnerability; hence, the attacker's certificate—which the application's policy would have rejected—is validated against the broader cached store.

Step 3 — Payload/Execution: At the vulnerability-class level, this is a TLS server-authentication bypass. The attacker must obtain a certificate from any public or private CA that exists in the cached store but is not in the callback's allow-list. For example, if the application pins a specific enterprise CA, the attacker could obtain a cheap domain-validated certificate from a public CA (e.g., Let's Encrypt) that is present in the system default store. The attacker presents this certificate during the TLS handshake on a server that impersonates the legitimate endpoint (via DNS spoofing, BGP hijacking, or a malicious captive portal).

Step 4 — Post-Exploitation Impact: Once TLS is established under the false identity, the attacker can decrypt and read all traffic—including authentication tokens (bearer tokens, session cookies, Basic Auth credentials)—and inject responses. The attacker gains full MITM capability. For an API client application, this could expose credentials that enable lateral movement into the backend systems. In IoT/embedded contexts where curl performs firmware updates, this could be leveraged to push malicious payloads. Notably, the application's logging may not flag the event because curl reports a successful TLS handshake—no certificate validation error is raised.

Impact Assessment

Business Impact: High. The vulnerability silently disables an application's explicit certificate-pinning policy. For enterprises, this undermines security controls used to protect API integrations, cloud service connections, and machine-to-machine communications. Any security audit that assumes curl's callback-based pinning is effective is invalidated on wolfSSL builds.

Affected Systems: Unspecified in the CVE entry, but logically: (1) curl built with --with-wolfssl; (2) applications calling curl_easy_setopt(handle, CURLOPT_SSL_CTX_FUNCTION, ...); (3) applications enabling CA caching—which is default in some libcurl configurations or explicitly enabled via CURLOPT_CA_CACHE_TIMEOUT. Real-world targets include embedded Linux devices, router firmware, smart home hubs, and enterprise software that links statically against curl+wolfSSL for licensing/license-check reasons.

Blast Radius: The flaw cannot be exploited remotely unless the attacker can already intercept network traffic (requires a network position). It is not a server-side RCE. However, the confidentiality and integrity impact is severe for any organization using affected builds—a single MITM interception can compromise credentials and data in transit.

CVSS Score: N/A (not scored by NVD). The vulnerability would likely score in the High range (8.1–9.0) given AV:N/AC:L/PR:N/UI:N and C:H/I:H, with limited scope. An informal approximation: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1.

Detection Guidance

Detection is challenging because the vulnerability does not produce malformed network traffic or error responses; a TLS handshake appears entirely legitimate. The attacker's certificate is signed by a real CA present in the system cache, so it will not trigger typical "self-signed cert" or "expired cert" alerts. Detection must focus on behavioral anomalies and configuration auditing.

Sigma Rule

title: Suspicious TLS Client Behavior - libcurl wolfSSL Trust Store Bypass
id: 1343ad77-9f02-4b53-a853-6ac6713a8e1f
status: experimental
description: Detects TLS clients that unexpectedly present certificates from a CA not matching the application's pinned profile. Monitors for repeated connections from the same process where the peer certificate CN/DNS changes rapidly.
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: 'curl'
    CommandLine|contains: 'https://'
  filter_known:
    CommandLine|contains:
      - '-k'
      - '--insecure'
  filter_pinned_cert:
    CommandLine|contains: '--cacert'
  condition: selection and not filter_known and not filter_pinned_cert
level: medium
falsepositives:
  - Legitimate applications using default system trust stores
  - Multi-tenant applications connecting to various endpoints
tags:
  - attack.t1190
  - cve.2026.82208

Note: This rule detects client processes using curl without a custom CA file argument—an indicator that they may rely on the default cached store and thus be vulnerable. It is a configuration audit, not direct exploit detection.

YARA Rule

rule CVE_2026_82208_wolfssl_truststore_bypass_strings
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects binary artifacts of curl linked against wolfSSL with CA cache and SSL_CTX callback features"
        date = "2026-08-01"
        cve = "CVE-2026-82208"
        reference = "NVD Description"
    strings:
        $s1 = "CURLOPT_SSL_CTX_FUNCTION" ascii wide
        $s2 = "wolfSSL_CTX_load_verify_locations" ascii wide
        $s3 = "curl_easy_setopt" ascii wide
        $s4 = "CA cache" ascii wide
        $wolfssl_marker = "wolfSSL" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and
        any of ($s*) and $wolfssl_marker or
        uint32(0) == 0x464C457F and
        any of ($s*) and $wolfssl_marker
}

Note: This YARA rule scans ELF/PE binaries for the combination of wolfSSL strings and libcurl opt-setting functions. It is a compilation fingerprint indicating a potentially vulnerable build—not direct exploit code detection.

Suricata IDS Rule

Suricata does not natively decode TLS application-layer certificate-pinning logic; this vulnerability manifests only during the TLS handshake validation step that occurs inside the client application. Synthetic detection may flag client connections that present an unusual chain where the leaf certificate does not match a previously-learned issuer for the same server, but issuers rotate legitimately. Therefore, no reliable network signature exists. A conservative overly-broad rule follows for environments that log client TLS handshakes (JA3 + issuer information) and can correlate anomalies:

alert tls any any -> any any (msg:"CVE-2026-82208 - Possible wolfSSL trust store tampering - unexpected CA chain"; 
    flow:to_server; 
    tls.store; 
    tls.cert_issuer:"!~CURL_PINNED_CA"; 
    sid:202682208; rev:1;)

This rule requires a reference rule variable CURL_PINNED_CA defined to the expected trusted issuer pattern; anything else triggers. High false-positive rate if the variable is not tuned.

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where event.type == "start" and process.name == "curl" and process.args like "*https://*"]
  [network where event.type == "connection" and network.protocol == "tls"
     and not network.direction == "inbound"]
  [file where event.type == "creator" and file.name == "*.pem" and process.name == "curl"]

EQL logic: Correlates a curl process spawning, making an outbound TLS connection, and simultaneously writing a custom PEM file (typical of callback-based store replacement). If this sequence occurs frequently with the same process but the destination IP changes or the TLS certificate issuer is inconsistent with the PEM contents, escalation is warranted.

Splunk SPL Query

index=proxy OR index=netflow 
| where dest_port=443 
| spath input=ssl_certificate path=issuer 
| table _time, src_ip, dest_ip, ssl_certificate.issuer, url 
| lookup pinned_cert_lookup dest_ip OUTPUT issuer as expected_issuer 
| where ssl_certificate.issuer != expected_issuer 
| stats count by src_ip, dest_ip, ssl_certificate.issuer 
| where count > 3

This query assumes an environment maintain a lookup table pinned_cert_lookup mapping known destination IPs to their expected TLS certificate issuers. Any connection whose issuer does not match the pinned value—persisting across more than three attempts—suggests the trust-store bypass is allowing validation of an unapproved certificate.

Wazuh OSSEC Rule

<group name="curl,pci_dss_10.6.1,">
  <rule id="291932" level="12">
    <decoded_as>json</decoded_as>
    <field name="process_name">^curl$</field>
    <field name="event_type">^command_executed$</field>
    <description>Curl process executed without explicit CA file. Potential CVE-2026-82208 exposure.</description>
    <group>access_control,cve_2026_82208,</group>
    <if_sid>57100</if_sid>  <!-- command exec via auditd -->
    <options>no_full_log</options>
  </rule>
</group>

<group name="syslog,tls,">
  <rule id="291933" level="10" frequency="8" timeframe="60">
    <if_matched_sid>2026822</if_matched_sid>
    <description>Multiple curl executions without CA pinning detected on same host - investigate for MITM impact.</description>
    <group>cve_2026_82208,</group>
  </rule>
</group>

First rule (level 12): Fires when curl runs without specifying --cacert or an equivalent flag on the command line—configurations susceptible to the bug. Second rule (aggregation): Correlates multiple such executions within a minute, indicating automated exploitation attempts or a compromised automation script.

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY — Debian has confirmed a fix across two independent sources; the patch confidence is rated Likely due to lack of an upstream curl release announcement for a specific version number).

1) Immediate Mitigations (until patch applied):

• Disable CA caching: Set CURLOPT_CA_CACHE_TIMEOUT to 0 in all application code paths that use CURLOPT_SSL_CTX_FUNCTION. This removes the stale-store reinstallation code path entirely. This is a one-line code change requiring an application rebuild/restart.
• Use CURLOPT_CAINFO or CURLOPT_CAPATH directly: Instead of relying on the CURLOPT_SSL_CTX_FUNCTION callback to load the custom store, pass the store directly via CURLOPT_CAINFO. This bypasses the callback mechanism and eliminates the vulnerable interaction.
• Switch TLS backends: If feasible, rebuild curl against OpenSSL or GnuTLS (--without-wolfssl). Only wolfSSL builds are affected.
• Network-layer mitigation: For enterprise endpoints, configure egress TLS inspection/proxy (e.g., via a forward proxy with SSL inspection) to terminate and re-evaluate all outbound TLS. This provides an independent validation layer that cannot be bypassed by client-side curl flaws.

2) Patch/Upgrade Steps:

• Debian-based systems: Check for updated packages: apt-cache policy curl and apt-get update && apt-get upgrade curl. Debian confirmed a fix; apply it as soon as it reaches your distribution's release channel. For Debian stable, enable buster-updates or equivalent.
• Source builds: Monitor the official curl GitHub repository (github.com/curl/curl) and the curl security mailing list for the upstream advisory (curl version will likely be 8.14.x or higher). When announced, rebuild with ./configure --with-wolfssl and verify the fix by testing the exact scenario: enable CA caching, set an CURLOPT_SSL_CTX_FUNCTION that replaces the trust store, and confirm a certificate from the old store is now rejected.
• Static linking: If your application statically links libcurl, obtain the patched source and recompile your entire dependency chain. Confirm the vendor of your SDK provides the patched wolfSSL integration—the bug may live in wolfSSL's adapter layer rather than curl core.

3) Long-Term Hardening:

• Certificate pinning policy: Review all code using CURLOPT_SSL_CTX_FUNCTION. Prefer CURLOPT_PINNEDPUBLICKEY for true pinning—it uses a hash comparison in curl core, independent of any TLS backend's trust store logic, and is immune to this class of bug.
• Formatting audit: Add a CI check/grep to your codebase ensuring that any use of CURLOPT_SSL_CTX_FUNCTION is accompanied by either CURLOPT_CAINFO or CURLOPT_PINNEDPUBLICKEY.
• Dependency scanning: Update your SBOM tooling to flag curl versions linked against wolfSSL. Subscribe to NVD RSS feeds and curl's security advisories (https://curl.se/docs/security.html).
• Monitoring: Deploy the detection rules above to baseline outbound certificate issuers. Establish automated alerting when an issuer changes for a static endpoint—this catches not only CVE-2026-82208 but also legitimate CA transitions (which should be scheduled and communicated).

References

1. NVD Entry (Primary): https://nvd.nist.gov/vuln/detail/CVE-2026-82208 — Archived CVE metadata including the description used in this report.
2. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-82208 — Confirmation of the fix and affected package versions (debian source package: curl).
3. curl Official Website — Security Advisories: https://curl.se/docs/security.html — Future upstream advisory will detail affected version ranges and the corrected release. Monitor this page for the curl-native announcement.
4. wolfSSL Security Advisories: https://www.wolfssl.com/wolfSSL/Support/advisories.html — For backend-side details on trust-store session persistence that may accompany the curl advisory.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Entry not listed at time of writing (status: NO); re-check periodically for exploitation-in-the-wild updates.

Threat Actor Activity: No known campaigns or exploit-in-the-wild evidence were reported as of 2026-08-01. The vulnerability requires pre-existing network position (MITM) for exploitation, which likely limits its attractiveness for mass automated exploitation in favor of targeted espionage or fraudulent certificate usage. Given the absence of a CVSS score (NVD) and EPSS data, prioritization should be based on direct asset inventory: exploit only systems confirmed to use wolfSSL + curl with the named callback. All other systems are unaffected and do not require emergency patching.