CVE-2026-81020

Executive Summary

CVE-2026-81020 is a cryptographic nonce-reuse vulnerability in wolfSSL's wolfEngine OpenSSL provider (versions before 1.4.1). When a TLS 1.2 or DTLS 1.2 session negotiates AES-GCM, wolfEngine generates the 8-byte explicit nonce once at write-key setup and never increments it per record, so every record in the connection is encrypted under the identical AES key and nonce pair. This catastrophic misuse of GCM breaks both confidentiality (keystream reuse) and integrity (GHASH authentication-key recovery, enabling tag forgery) for any affected TLS 1.2/DTLS 1.2 AES-GCM session, though AES-CCM, TLS 1.3, and non-TLS cipher use are unaffected.

Technical Analysis

AES-GCM is a nonce-based AEAD. Its security contract requires that a given (key, nonce) pair never be reused across two distinct plaintexts. The nonce in TLS 1.2/DTLS 1.2 AES-GCM is constructed as an implicit 4-byte salt (from the key block) concatenated with an 8-byte explicit nonce that is transmitted in each record header; the explicit portion is intended to change for every record so the effective 96-bit nonce is globally unique per key.

Per the NVD description, wolfEngine before 1.4.1 violates this contract: it generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. Consequently, every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under the same key and the same 96-bit nonce.

Two cryptographic failures follow directly:

1. Keystream reuse (confidentiality loss). GCM encryption is C = P XOR KS, where KS is the keystream derived from the counter block seeded by the nonce. Because the nonce is fixed, KS is identical for all records. Therefore C1 XOR C2 = P1 XOR P2 — the XOR of two ciphertexts equals the XOR of their plaintexts. This is the classic two-time-pad condition. If an attacker knows or can guess any one plaintext record (e.g., a predictable HTTP response header, a well-known protocol message, or attacker-influenced plaintext), they can XOR it against the corresponding ciphertext to recover the keystream and thereby decrypt any other record encrypted under the same key/nonce.

2. GHASH key recovery and tag forgery (integrity loss). GCM's authentication tag is computed over the ciphertext and associated data using GHASH, a polynomial evaluation keyed by H = AES_K(0^128). Nonce reuse exposes the underlying algebraic relationship across multiple tag/ciphertext pairs under the same key, leaking the GHASH authentication key H. Once H is recovered, an attacker can compute valid authentication tags for arbitrary forged records, allowing injection or modification of records that the peer will accept as authentic.

The vulnerability is specific to the wolfEngine AES-GCM path for TLS 1.2 and DTLS 1.2. AES-CCM uses a different nonce/authentication construction and is unaffected. TLS 1.3 derives per-record nonces differently and is unaffected. Non-TLS use of the cipher (i.e., AES-GCM outside the TLS record layer) is also unaffected, indicating the defect is in wolfEngine's TLS record nonce management rather than in the underlying primitive.

CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N = 7.4 (High). The High attack complexity reflects the requirement to recover or influence a plaintext record to fully exploit keystream reuse, and/or to obtain enough ciphertext/tag pairs to recover the GHASH key. No privileges and no user interaction are required, and confidentiality and integrity impacts are High.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available (POC_STATUS: None). The attack chain below is inferred strictly from the vulnerability class (AEAD nonce reuse) and the mechanics stated in the NVD description. No implementation-specific function, endpoint, or parameter names are asserted.

1. Reconnaissance / target identification. An attacker identifies a target endpoint whose TLS 1.2 or DTLS 1.2 handshake negotiates AES-GCM and whose stack uses an affected wolfEngine build (< 1.4.1). TLS 1.3 is not susceptible, so the attacker forces or observes a TLS 1.2/DTLS 1.2 AES-GCM cipher suite selection. Network position is required: a passive on-path observer (consistent with T1040, Network Sniffing) or an active adversary-in-the-middle (T1557). For DTLS 1.2, UDP-based transport broadens the reachable attack surface.

2. Triggering the flaw. The flaw is triggered automatically by normal application traffic: once the write key is set, every AES-GCM record in the connection reuses the one generated explicit nonce, with no attacker-supplied input needed. The attacker simply captures the resulting records. No payload is required to cause nonce reuse itself; the defect is triggered by the victim sending two or more records.

3. Plaintext recovery / forgery at the vulnerability-class level. The attacker collects multiple ciphertext records from the same connection. Because all records share a key and nonce:

   • Keystream recovery: if the attacker knows, guesses, or can dictate one plaintext record, they XOR it with the matching ciphertext to obtain the keystream, then XOR the keystream against other ciphertexts to recover their plaintexts (classic two-time-pad recovery).
   • GHASH key recovery: by accumulating ciphertext/tag pairs under the reused nonce, the attacker recovers the GHASH authentication key, after which they can forge valid authentication tags for arbitrary records. This enables tampering with, or injection of, records that the peer accepts as authentic.

Initial access enablers such as attacker-injected plaintext (to bootstrap known-plaintext for keystream recovery) and control of network framing are the primary operational requirements; the AC:H rating reflects these preconditions.

4. Post-exploitation impact. Successful recovery of record plaintext can expose session contents (credentials, tokens, application data) carried over the affected connection — a confidentiality compromise. Successful tag forgery undermines the integrity of the channel: an active attacker can alter or inject records the peer accepts, potentially enabling content manipulation or session-level abuse of the application protocol carried inside TLS. Neither impact implies remote code execution on its own; the consequence is a cryptographically broken transport channel.

Impact Assessment

Business impact centers on loss of confidentiality and integrity for data in transit over affected TLS 1.2/DTLS 1.2 AES-GCM connections. Any application, service, appliance, or embedded product that embeds wolfEngine < 1.4.1 and terminates or originates TLS/DTLS 1.2 with AES-GCM is in scope. Because the defect is at the library/provider layer, the blast radius is every connection handled by that build, not a single endpoint.

CVSS subscores:

• Confidentiality (C:H): keystream reuse enables recovery of record plaintext, including any known-plaintext-anchored decryption of other records.
• Integrity (I:H): GHASH authentication-key leakage enables authentication tag forgery and record tampering/injection.
• Availability (A:N): no direct availability impact is described.
• Attack Vector (AV:N), AC:H, PR:N, UI:N, S:U.

Rated 7.4 (High). EPSS is 0.00383 (~29.8th percentile), indicating low predicted near-term exploitation activity as of the data snapshot. CISA KEV: NO — no confirmed exploitation in the wild. No public PoC/exploit and no Nuclei template are available. The practical severity is amplified for DTLS 1.2 deployments (UDP transport eases on-path capture) and for environments where long-lived TLS 1.2 sessions carry many records (more material for keystream and GHASH-key recovery).

Detection Guidance

Because this is a cryptographic nonce-reuse defect, network signatures can only approximate exploitation: the most concrete observable is repeated identical 8-byte explicit-nonce values within a single TLS 1.2/DTLS 1.2 AES-GCM record stream from one endpoint. General TLS metadata and library/version telemetry detection are provided below.

Sigma Rule

title: wolfEngine AES-GCM Nonce Reuse - TLS 1.2/DTLS 1.2 (CVE-2026-81020)
id: 3f9c1a72-6b21-4d8e-9a4f-81020cve0001
status: experimental
description: Detects TLS/DTLS 1.2 sessions negotiating AES-GCM on hosts whose wolfEngine version is below 1.4.1, which is vulnerable to per-record nonce reuse (CVE-2026-81020).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-81020
author: threat-intel
logsource:
  category: process_creation
  product: linux
detection:
  selection_lib:
    - CommandLine|contains:
        - 'wolfengine'
        - 'libwolfengine'
        - 'wolfSSL'
  selection_load:
    ImageLoaded|contains:
      - 'libwolfengine.so'
      - 'wolfengine.dll'
  version_vulnerable:
    CommandLine|re: 'wolfengine[^0-9]*1\.(0|1|2|3)\.[0-9]+'
  condition: (selection_lib or selection_load) and version_vulnerable
falsepositives:
  - Inventory or update scripts referencing wolfEngine without loading it
level: medium
tags:
  - attack.t1040
  - cve.2026.81020

YARA Rule

rule CVE_2026_81020_wolfEngine_AESGCM_vuln
{
    meta:
        description = "Detects wolfEngine builds prior to 1.4.1 affected by AES-GCM nonce reuse (CVE-2026-81020)"
        cve = "CVE-2026-81020"
        author = "threat-intel"
        date = "2026-01-01"
        severity = "high"

    strings:
        $lib1 = "wolfengine" ascii wide nocase
        $lib2 = "libwolfengine" ascii wide nocase
        $ver_1_0 = "1.0." ascii
        $ver_1_1 = "1.1." ascii
        $ver_1_2 = "1.2." ascii
        $ver_1_3 = "1.3." ascii
        $gcm = "AES-GCM" ascii wide
        $tls12 = "TLSv1.2" ascii wide
        $dtls12 = "DTLSv1.2" ascii wide

    condition:
        filesize < 20MB and
        ($lib1 or $lib2) and
        any of ($ver_1_0, $ver_1_1, $ver_1_2, $ver_1_3) and
        (($gcm) or ($tls12) or ($dtls12))
}

Suricata IDS Rule

alert tls any any -> any any (msg:"CVE-2026-81020 wolfEngine AES-GCM TLS1.2/DTLS1.2 nonce-reuse build detected"; flow:established,to_server; tls.version:1.2; app-layer-ssl.cipher-suite:0xC02F; threshold:type limit, track by_src, count 1, seconds 300; classtype:attempted-recon; reference:cve,2026-81020; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-81020; metadata:service tls; sid:8102001; rev:1;)

Note: TLS 1.2 AES-GCM cipher suites such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xC02F) identify candidate sessions; correlate with wolfEngine version telemetry because the nonce-reuse condition itself is not visible in the clear-text handshake beyond cipher-suite negotiation.

Elastic Detection

sequence by host.id with maxspan=5m
  [ process where process.name != null and
      process.command_line regex ".*wolfengine[^0-9]*1\\.[0-3]\\.[0-9]+.*" ]
  [ network where network.direction == "egress" and
      tls.version == "1.2" and
      tls.server.cipher contains "AES" and
      tls.server.cipher contains "GCM" ]

Splunk SPL Query

index=main (source="*wolfengine*" OR CommandLine="*wolfengine*" OR ImageLoaded="*wolfengine*")
| rex field=CommandLine "(?i)wolfengine[^0-9]*(?<ver>1\.[0-3]\.[0-9]+)"
| where isnotnull(ver)
| join type=left host
    [ search index=network (tls_version="TLS 1.2" OR tls_version="DTLS 1.2")
      (cipher="*AES*GCM*") | stats count by host ]
| table host ver count
| sort - count

Wazuh OSSEC Rule

<group name="wolfengine,cve-2026-81020,">
  <rule id="810201" level="10">
    <decoded_as>json</decoded_as>
    <field name="CommandLine">wolfengine</field>
    <regex field="CommandLine">wolfengine[^0-9]*1\.[0-3]\.[0-9]+</regex>
    <description>CVE-2026-81020: vulnerable wolfEngine (&lt;1.4.1) AES-GCM nonce reuse build observed.</description>
    <mitre>
      <id>T1040</id>
    </mitre>
    <group>crypto,tls,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version mapping is currently recorded in the tracked sources; the remediation target below is derived solely from the NVD description ("wolfEngine before 1.4.1").

1. Immediate mitigations:

   • Prefer TLS 1.3 wherever both peers support it, since TLS 1.3 uses a different per-record nonce derivation and is explicitly unaffected.
   • Where TLS 1.2/DTLS 1.2 must be used, disable AES-GCM cipher suites and negotiate AES-CCM instead; AES-CCM is explicitly stated as not affected by this defect.
   • Reduce record volume and session lifetime over affected links to limit material available for keystream and GHASH-key recovery, and avoid transmitting high-value secrets over TLS 1.2 AES-GCM channel until remediated.
   • Treat affected TLS 1.2/DTLS 1.2 AES-GCM connections as confidentiality- and integrity-broken for network-path threat models; restrict them from untrusted network segments where feasible.

2. Patch/upgrade steps:

   • Upgrade wolfEngine to 1.4.1 or later, which is the version identified in the NVD description as the fix boundary.
   • Because no vendor advisory or patch reference is currently tracked, verify the upgrade against the wolfSSL/wolfEngine release notes and confirm the AES-GCM per-record nonce handling is corrected before relying on it.
   • Re-key or restart long-lived TLS 1.2/DTLS 1.2 AES-GCM sessions after upgrading so connections established on the vulnerable build are torn down.

3. Long-term hardening:

   • Standardize on AEAD constructions with robust per-record nonce management and deprecate TLS 1.2/DTLS 1.2 where practical.
   • Add SBOM-driven tracking of crypto libraries and providers (wolfEngine/wolfSSL) so vulnerable builds are inventoried and flagged, given the patch confidence is currently 0/4.
   • Implement cryptographic misuse monitoring (e.g., alerting on repeated nonce values within a keystream) and prefer vetted crypto test vectors for TLS record-layer nonce handling in CI.
   • Maintain defense-in-depth on transport trust assumptions and plan for crypto-agility to rotate cipher suites and libraries quickly.

References

• NVD — CVE-2026-81020: https://nvd.nist.gov/vuln/detail/CVE-2026-81020
• MITRE CWE-323 — Reusing a Nonce, Key Pair in Encryption: https://cwe.mitre.org/data/definitions/323.html
• wolfSSL / wolfEngine product and release information: https://www.wolfssl.com/products/wolfengine/
• NIST SP 800-38D — Recommendation for Block Cipher Modes of Operation: GCM (nonce-uniqueness requirement): https://csrc.nist.gov/pubs/sp/800/38/d/final
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-81020 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-81020 at this time; CISA KEV status is NO, no public PoC exists and EPSS remains low (0.00383, ~29.8th percentile).