Wolfssl: When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey… (CVE-2026-89136)

The wolfSSL library has a vulnerability identified as CVE-2026-89136 affecting the client side of TLS 1.2, 1.3, and DTLS 1.2 connections when using Raw Public Key (RPK) authentication. Specifically, the client may accept an unsolicited server_cert_type=RawPublicKey message, which can allow a malicious or misbehaving server to bypass the intended authentication mechanisms. This issue arises only when RPK support is enabled via build options such as --enable-rpk, --enable-all, or --enable-distro (HAVE_RPK).

A malicious or misbehaving server can bypass client authentication checks when RPK is enabled, potentially leading to unauthorized access or man-in-the-middle scenarios. However, since RPK is off by default, the exposure is limited to environments where RPK is explicitly enabled. There are no known exploits in the wild at this time.

Users should ensure that wolfSSL builds do not enable RPK unless necessary. If RPK is required, monitor vendor advisories for patches or updates addressing this vulnerability. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.