CVE-2026-89135 Failed X509_verify_cert leaves unverified CA in shared CertManager

Medium 6.3 Published 27 Sep 2026 Updated 29 Sep 2026

Attackers can bypass certificate validation in wolfSSL by planting an unverified CA, requiring specific OpenSSL compatibility macros and X509_verify_cert usage.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-89135?

CVE-2026-89135 is a medium-severity vulnerability in Wolfssl Wolfssl, published on 27 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every type-blind sibling consumer (native TLS, OCSP, CRL, direct CM verify). This affects version 5.8.4 through 5.9.2 of wolfSSL with the macros (OPENSSL_EXTRA && !NO_CERTS && !WOLFCRYPT_ONLY) defined or built with --enable-opensslextra and the application is specifically making calls to the X509_verify_cert function.

Weakness: CWE-295

Which versions are affected by CVE-2026-89135?

It affects 1 product.

Products include Wolfssl Wolfssl.

How do I fix CVE-2026-89135?

No fix has been published for CVE-2026-89135 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-89135 being exploited?

There is no known exploitation of CVE-2026-89135 in the wild and no public exploit code.

All Wolfssl Wolfssl vulnerabilities

Sources

Also known as AZL-105191, DEBIAN-CVE-2026-89135, GHSA-m732-8qwx-39wm, UBUNTU-CVE-2026-89135.