Is CVE-2026-89136 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89136 being exploited in the wild.

How severe is CVE-2026-89136?

Informational severity, published 27 September 2026.

Which products and versions are affected?

Wolfssl Prior to fix in PR #11009 (merged August 2026).

Is there a fix for CVE-2026-89136?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-89136 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-89136?

Check whether you run Wolfssl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89136: wolfSSL TLS authentication bypass in Raw Public Key handling

CVE-2026-89136 · Severity: info · Published 2026-09-27

wolfSSL is a cryptography library used to secure TLS and DTLS connections. When Raw Public Key (RPK) authentication is enabled, a malicious server can bypass client-side authentication checks by sending an unsolicited certificate type, potentially allowing an attacker to impersonate a legitimate server. This vulnerability affects TLS 1.2, TLS 1.3, and DTLS 1.2 connections.

Technologies: Wolfssl. Vendors: Wolfssl.

Quick answers

Is CVE-2026-89136 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89136 being exploited in the wild.
How severe is CVE-2026-89136?: Informational severity, published 27 September 2026.
Which products and versions are affected?: Wolfssl Prior to fix in PR #11009 (merged August 2026).
Is there a fix for CVE-2026-89136?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-89136 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-89136?: Check whether you run Wolfssl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in wolfSSL's TLS 1.2, 1.3, and DTLS 1.2 implementations when RPK support is compiled in. The client fails to properly validate the server_cert_type negotiation, allowing a misbehaving server to inject an unsolicited RawPublicKey certificate type and bypass authentication checks. The flaw is only present in builds compiled with --enable-rpk, --enable-all, or --enable-distro flags.

Affected products

wolfSSL wolfSSL Prior to fix in PR #11009 (merged August 2026)

Timeline

2026-09-27: disclosed

References

https://github.com/wolfSSL/wolfssl/pull/11009

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.