CVE-2026-891368.3HighCWE-287
CVE-2026-89136: Client accepts unsolicited RawPublicKey server certificate type
No fix listed · Affected: wolfSSL · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
0.4%probability of exploitation in the next 30 days
33rd percentile
050100
Higher than 33% of scored CVEs
8.3HighCVSS 4.0
LowMediumHighCrit.
DescriptionNVD
When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR --enable-distro AKA HAVE_RPK builds.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- wolfSSL
- Published
- September 2026
Coverage2 articles · 2 outlets
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 29 Sep.
Quiet for 7 weekslast report 30 Sep2 articles2 outlets
- Tue 29 Sep, 05:20 UTC. SecurityOnline, first report. wolfSSL Fixes Certificate Verification Flaws Affecting IoT Devices.
- Wed 30 Sep, 07:13 UTC. SecurityWeek, its first report on the story. OpenSSL and WolfSSL Patch Flaws Threatening TLS Authentication.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 29 Sep 05:20 | SecurityOnline | wolfSSL Fixes Certificate Verification Flaws Affecting IoT Devices |
| 30 Sep 07:13 | SecurityWeek | OpenSSL and WolfSSL Patch Flaws Threatening TLS Authentication |
- OpenSSL and WolfSSL Patch Flaws Threatening TLS AuthenticationSecurityWeek · mentions it in passing
- wolfSSL Fixes Certificate Verification Flaws Affecting IoT DevicesSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.