X509 Verification Bypass in wolfSSL Affects Multiple Versions
CVE-2026-89135

6.3MEDIUM

Key Information:

Vendor

Wolfssl

Status
Wolfssl
Vendor
CVE Published:
27 September 2026

What is CVE-2026-89135?

An implementation flaw in wolfSSL versions 5.8.4 to 5.9.2 allows an unverified attacker Certificate Authority (CA) to bypass crucial certificate validation during operations where X509 verification is utilized. When the X509_verify_cert function is invoked, the failure of this call can result in the permanent embedding of a malicious CA in the shared CertManager. This effectively compromises the integrity of certificate validation across various consumer types, including native TLS, OCSP, CRL, and direct CertManager verification. This vulnerability poses significant risks and should be addressed promptly to ensure secure communication.

Affected Version(s)

wolfSSL 5.8.4 <= 5.9.2

References

https://github.com/wolfSSL/wolfssl/pull/11009

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Christos Papakonstantinou (Cantina Security)
.