Every CVE Search/ Get API key

CVE-2026-89136

Client accepts unsolicited RawPublicKey server certificate type

8.3 HighFix available

CVE-2026-89136 is a high vulnerability (CVSS 8.3) in Wolfssl, published September 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in wolfssl 5.9.4-r0.

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
None

Exploit likelihood

0.38%Down 0.2 points since Sep 27, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.3

Client accepts unsolicited RawPublicKey server certificate type

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

Record
CVE-2026-89136
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-287
Updated
2026-11-02
EUVDEUVD-2026-87911 8.3

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

Record
EUVD-2026-87911
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-qqgw-76jp-m5f3 8.3

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could...

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

Record
GHSA-qqgw-76jp-m5f3
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-287
Updated
2026-11-02
NVD 8.3

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

Record
CVE-2026-89136
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-287
Updated
2026-11-02
OSVALPINE-CVE-2026-89136 8.3

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

Record
ALPINE-CVE-2026-89136
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-03
OSV 8.3

Client accepts unsolicited RawPublicKey server certificate type

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

Record
CVE-2026-89136
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-287
Updated
2026-11-02
OSVDEBIAN-CVE-2026-89136 8.3

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

Record
DEBIAN-CVE-2026-89136
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-89136 8.3

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

Record
UBUNTU-CVE-2026-89136
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVAZL-105179 No score

CVE-2026-89136 affecting package mariadb 10.11.19-1

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

Record
AZL-105179
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wolfssl
Alpine:v3.24
 before 5.9.4-r0
5.9.4-r0
mariadb
Azure Linux:3
 through 10.11.19-1 None known
wolfssl
Debian:13
 All versions, plus listed versions
5.7.2-0.15.7.2-0.1+deb13u15.7.2-0.1+deb13u25.7.2-0.25.7.2-0.3
Show 9 moreShow less
5.7.2-0.45.8.2-15.8.2-1.15.8.2-1.25.8.4-15.9.0-0.15.9.0-0.25.9.1-0.15.9.2-1
 None known
wolfssl
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.4.8+dfsg-1
 None known
wolfssl
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.10.2+dfsg-23.12.0+dfsg-13.12.2+dfsg-13.13.0+dfsg-1
 None known
wolfssl
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.1.0+dfsg-24.2.0+dfsg-14.2.0+dfsg-24.2.0+dfsg-34.3.0+dfsg-2
 None known
wolfssl
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.6.0-35.0.0-15.1.1-15.2.0-15.2.0-2
 None known
wolfssl
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.5.4-25.5.4-2.15.6.4-25.6.6-1.25.6.6-1.35.6.6-1.3build1
 None known
wolfssl
Ubuntu:26.10
 All versions, plus listed versions
5.9.1-0.15.9.2-1
 None known
wolfssl
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.7.2-0.15.8.2-1.25.8.4-15.9.1-0.1
 None known

History

History
WhenChangedSources
2026-11-03affected, aliases, facts, referencesOSV
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open