What’s Vulnerable › Vulnerabilities

CVE-2026-89136: Client accepts unsolicited RawPublicKey server certificate type

• Severity: high (CVSS 8.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-27 · updated 2026-09-29
• Weakness: CWE-287

Description

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

Affected products

• wolfSSL: from 5.6.0 through 5.9.2

References

• https://github.com/wolfSSL/wolfssl/pull/11009

Get alerted when CVE-2026-89136 or the next vulnerability affects your stack