CVE-2026-89136

CVE Enrichment

CVSS: 8.3 HIGH
EPSS: 0.55%
EPSS Percentile: 44.92%
CISA KEV: Not listed

Description

When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: facts@wolfssl.com
Published: 27-Sep-2026 17:16
Last Modified: 30-Sep-2026 00:17
EPSS Date: 2026-10-16
CWE: CWE-287

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:P /
                            PR:N /
                            UI:N /
                            VC:L /
                            VI:H /
                            VA:N /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

facts@wolfssl.com

Last enrichment sync: 17-Oct-2026 08:01
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2026-89136 lets a malicious server bypass authentication on clients with Raw Public Key support enabled by selecting an RPK certificate type the client never requested. OpenSSL and WolfSSL Patch High-Severity Vulnerabilities

CVE (4)

Vendors (2)

Products (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.