CVE-2026-89136
Received Received - Intake

TLS Server RPK Authentication Bypass in wolfSSL

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: wolfSSL Inc.

Description
When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-89136
EUVD
EUVD-2026-87911

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wolfssl wolfssl From 1.2 (inc) to 1.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects wolfSSL's TLS and DTLS implementations when RPK (Raw Public Key) is enabled. A malicious server could send an unsolicited server_cert_type=RawPublicKey to bypass authentication, allowing unauthorized access. RPK is disabled by default and requires specific build configurations like --enable-rpk or --enable-all.

Detection Guidance

Detection requires checking if your wolfSSL build includes RPK support and if the server sends an unsolicited server_cert_type=RawPublicKey. Inspect build flags for --enable-rpk, --enable-all, or --enable-distro. Monitor TLS/DTLS handshakes for unexpected RawPublicKey certificate types.

Impact Analysis

If you use wolfSSL with RPK enabled, an attacker could impersonate a server to intercept or manipulate data. This could lead to data breaches, unauthorized access to sensitive information, or man-in-the-middle attacks. Systems relying on RPK for authentication are at higher risk.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strong authentication and data protection, such as GDPR's encryption standards or HIPAA's safeguards for protected health information. Failure to address it may result in non-compliance penalties or legal risks.

Mitigation Strategies

Disable RPK support by rebuilding wolfSSL without --enable-rpk, --enable-all, or --enable-distro flags. Update to a patched version if available. Ensure servers do not send unsolicited server_cert_type=RawPublicKey.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89136. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart