What is the CVSS score of CVE-2026-80230?

CVE-2026-80230 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of libcurl are affected by CVE-2026-80230?

libcurl versions 7.45.0 through 8.21.0 have a flaw that allows network-positioned attackers to bypass encrypted connection protections when applications use a specific security configuration…

How to fix or mitigate CVE-2026-80230?

Within 24 hours, inventory all systems running libcurl versions 7.45.0-8.21.0 and identify which applications use CURLOPT_PINNEDPUBLICKEY combined with both CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0. Within 7 days, for each affected application, either enable standard certificate chain verification (recommended immediate fix) or plan an upgrade to a version outside the vulnerable range. Within 30 days, execute the upgrade plan to move all affected instances to libcurl versions prior to 7.45.0 or 8.22.0 and later, and establish a security policy prohibiting reliance on pinning as the sole TLS validation mechanism.

libcurl CVE-2026-80230

EUVD-2026-72168 HIGH

Improper Certificate Validation (CWE-295)

2026-09-02

GHSA-2xgv-7q8p-67gc

Authentication Bypass

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.4 HIGH

Pinning bypass enables MITM yielding C:H/I:H with no availability impact; AC:H because the non-default dual-verification-disable configuration is required and outside the attacker's control.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Sep 08, 2026 - 19:48 vuln.today

v3 (cvss_changed)

Analysis Updated

Sep 08, 2026 - 19:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 08, 2026 - 19:23 vuln.today

cvss_changed

CVSS changed

Sep 08, 2026 - 19:23 NVD

7.5 (HIGH)

Analysis Generated

Sep 02, 2026 - 12:19 vuln.today

CVE Published

Sep 02, 2026 - 10:57 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Certificate Pinning Bypass in OpenSSL/curl before 8.22.0 - CVE-2026-80230 Sep 03, 2026

AnalysisAI

Public key pinning enforcement in libcurl (versions 7.45.0 through at least 8.21.0) is silently bypassed when CURLOPT_PINNEDPUBLICKEY is combined with CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0 - the exact configuration adopted by applications that rely on pinning as their sole TLS trust anchor after disabling standard certificate chain validation. When a server presents no certificate at all, libcurl's pin-check code path is never reached and the connection succeeds, enabling a network-positioned attacker to conduct MITM attacks against applications that believed pinning would protect them. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires three simultaneous non-default conditions: (1) the target application must have explicitly configured CURLOPT_PINNEDPUBLICKEY with a pinned key hash; (2) the same application must have set CURLOPT_SSL_VERIFYPEER=0, disabling certificate chain validation (the secure default is 1); and (3) the same application must have set CURLOPT_SSL_VERIFYHOST=0, disabling hostname verification (the secure default is 2). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The real-world impact differs substantially from what the provided CVSS vector implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Consult the primary curl advisory at https://curl.se/docs/CVE-2026-80230.html for the confirmed patched version. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems running libcurl versions 7.45.0-8.21.0 and identify which applications use CURLOPT_PINNEDPUBLICKEY combined with both CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0. …

Threat intelligence, references, and detailed analysis are available after sign-in.