CVE-2026-89136 - Client accepts unsolicited RawPublicKey server certificate type · CoreCVE

Back Back to CVE browser

HIGH

Client accepts unsolicited RawPublicKey server certificate type

Published Sep 27, 2026

8.3

HIGH

CVSS 4.0

EPSS 0.55%

Description

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

Affected products

Vendor wolfSSL Product wolfSSL Default
unaffected
- Version
  5.6.0
  Status
  affected
  Constraints
  <=5.9.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
5.6.0	affected	<=5.9.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87911		Advisory
https://github.com/wolfSSL/wolfssl/pull/11009

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner wolfSSL

Published Sep 27, 2026

Updated Sep 29, 2026

Reserved Sep 10, 2026

Link CVE-2026-89136

CISA Vulnrichment

Updated Sep 29, 2026

Status Received

Modified Sep 27, 2026

Link CVE-2026-89136

Severity n/a

Public date n/a

Links CVE-2026-89136

Assigner wolfSSL

Published Sep 27, 2026

Updated Sep 29, 2026

Exploited since n/a

Link EUVD-2026-87911

EUVD-2026-87911