CVE-2026-13608: Haxx Curl SASL Auth Bypass Vulnerability

CVE-2026-13608 Overview

A flaw in the libcurl Simple Authentication and Security Layer (SASL) negotiation for Lightweight Directory Access Protocol (LDAP) authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker positioned to perform a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation. The weakness maps to CWE-923: Improper Restriction of Communication Channel to Intended Endpoints. The vulnerability affects applications and services that rely on libcurl for authenticated LDAP or LDAPS communication.

Critical Impact
An on-path attacker can bypass SASL peer validation during LDAP authentication, undermining confidentiality and integrity of directory traffic without triggering authentication errors.

Affected Products

Haxx curl (libcurl) versions compiled with LDAP/LDAPS support
Applications and services statically or dynamically linking vulnerable libcurl builds
Automation, backup, and directory-integration tooling that uses libcurl for LDAP SASL binds

Discovery Timeline

2026-09-06 - CVE-2026-13608 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database
Vendor advisory published at the cURL CVE-2026-13608 Advisory
Coordinated disclosure tracked through HackerOne Report #3822248

Technical Details for CVE-2026-13608

Vulnerability Analysis

libcurl implements SASL as a challenge-response negotiation used by several protocols, including LDAP. During a SASL bind, the client and server exchange messages that progressively confirm cryptographic parameters and peer identity. In the vulnerable code path, libcurl treats certain shortcut or truncated server responses as if the full negotiation had completed successfully. This means the client transitions into an authenticated state before all validation steps have run.

An attacker who can intercept traffic between the client and the LDAP server injects a crafted response that mimics a fast-path success signal. libcurl accepts this response, skips the remaining verification exchange, and proceeds as if the peer were trusted. Subsequent LDAP operations then run over a channel the attacker controls. Because the flaw requires an active network position, exploitation complexity is higher than a purely remote attack, but the impact on confidentiality and integrity is significant.

Root Cause

The root cause is missing enforcement of a strict state machine in the LDAP SASL negotiation. The client accepts server messages out of order and treats intermediate states as terminal. Without binding the negotiation outcome to full cryptographic verification, libcurl fails to restrict the communication channel to the intended, validated endpoint, matching the CWE-923 pattern.

Attack Vector

Exploitation requires an attacker with a MITM position on the network path between the libcurl client and the LDAP server. This includes attackers with control of intermediate routers, rogue Wi-Fi infrastructure, ARP or DNS spoofing capability, or compromised upstream network devices. No user interaction and no prior authentication are required. Once the shortcut response is accepted, the attacker can proxy, observe, or modify LDAP queries and responses, including directory reads, writes, and credential-related operations.

Refer to the cURL CVE-2026-13608 Advisory for the authoritative technical breakdown and affected version ranges.

Detection Methods for CVE-2026-13608

Indicators of Compromise

LDAP or LDAPS sessions from libcurl-based clients that complete SASL binds in fewer exchanges than the configured mechanism normally requires.
Unexpected certificate chains, TLS session resumption anomalies, or protocol downgrades on ports 389 and 636.
LDAP traffic traversing hosts or network segments that are not part of the sanctioned directory path.

Detection Strategies

Inventory all binaries and container images that link libcurl and cross-reference versions against the cURL CVE-2026-13608 Advisory.
Inspect packet captures of LDAP SASL binds and flag sessions where the client transitions to authenticated state after a single server message.
Correlate directory server authentication logs with client-side libcurl telemetry to identify sessions that bypass mechanism-specific challenge rounds.

Monitoring Recommendations

Alert on new or unapproved network paths carrying LDAP or LDAPS traffic to production directory services.
Monitor egress from application servers for LDAP connections to unexpected destinations that could indicate MITM redirection.
Enable verbose SASL logging on directory servers to record mechanism, negotiated security layers, and bind duration for anomaly baselining.

How to Mitigate CVE-2026-13608

Immediate Actions Required

Upgrade libcurl to the fixed version identified in the cURL CVE-2026-13608 Advisory across all operating systems, container images, and embedded appliances.
Rebuild and redeploy applications that statically link libcurl once patched sources are available.
Rotate credentials that may have been used over untrusted networks by libcurl-based LDAP clients during the exposure window.

Patch Information

Haxx published a fix through the curl project. Consult the cURL CVE-2026-13608 Advisory and the machine-readable cURL CVE-2026-13608 JSON Data for the exact fixed version, affected version ranges, and commit references. Distribution-provided libcurl packages should be updated through the vendor's standard package channels.

Workarounds

Route LDAP traffic exclusively over LDAPS with strict certificate validation and pin trusted certificate authorities where feasible.
Restrict libcurl-based LDAP clients to directory servers reachable only through trusted network segments or mutually authenticated tunnels such as IPsec.
Where patching is delayed, disable libcurl LDAP support in builds that do not require it by compiling with --disable-ldap and --disable-ldaps.

bash

# Configuration example: rebuild libcurl without LDAP support until patched
./configure --disable-ldap --disable-ldaps --with-openssl
make && sudo make install

# Verify the running libcurl version after patching
curl --version