CVE-2026-80230 OpenSSL pinning bypass

High 7.5 Published 6 Sep 2026 Updated 15 Sep 2026

libcurl fails to enforce public key pinning when peer verification is disabled, allowing unauthenticated connections to bypass security checks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-80230?

CVE-2026-80230 is a high-severity vulnerability in Haxx Curl, published on 6 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.

Weakness: CWE-295

Which versions are affected by CVE-2026-80230?

It affects 1 product.

Products include Haxx Curl.

How do I fix CVE-2026-80230?

Apply the vendor's patch.

Is CVE-2026-80230 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-80230 exists.

All Haxx Curl vulnerabilities

Sources

Also known as ALPINE-CVE-2026-80230, AZL-99770, AZL-99789, AZL-99816, AZL-99846, AZL-99873 and 14 more.