CVE-2026-89134

Executive Summary

CVE-2026-89134 is a certificate name-constraint bypass vulnerability in the wolfSSL TLS/SSL library, specifically affecting how the library validates dNSName Subject Alternative Names (SANs) against certificate name constraints. The flaw allows a certificate containing no dNSName SAN but another SAN type (such as registeredID or iPAddress) to bypass the Subject CN dNSName name-constraint check when the certificate's Common Name (CN) is out of the permitted scope. Affected systems are those using wolfSSL 5.9.2 or later builds containing the incomplete fix for CVE-2026-6731, which rely on name constraints for certificate chain validation. The impact is a weakened trust boundary during certificate validation, potentially allowing a certificate issued by a constrained intermediate CA to be accepted for an out-of-scope DNS name, undermining the security guarantees of the Public Key Infrastructure.

Technical Analysis

The vulnerability resides in wolfSSL's X.509 certificate path validation logic, specifically in the name-constraint enforcement for dNSName entries. Name constraints are an X.509 extension that allows a CA to restrict the set of names (DNS names, IP addresses, directory names, etc.) that certificates issued within its hierarchy may use. When a name constraint for dNSName is present, any certificate in the chain must have its DNS names fall within the permitted subtree.

The specific mechanism of this vulnerability is as follows: when a certificate does not have a dNSName SAN, but does have another SAN type present (e.g., registeredID or iPAddress), the implementation intended to fall back to using the certificate's Subject Common Name (CN) as a DNS name for name-constraint comparison. However, the fallback condition was gated incorrectly. The implementation checked:

cert->subjectCN != NULL && cert->altNames == NULL && !cert->isCA

The correct condition should have been "no dNSName SAN present" rather than "altNames == NULL". Because altNames is non-NULL whenever any SAN type exists (including registeredID or iPAddress), a certificate that has a SAN but no dNSName SAN bypasses the CN-as-DNS fallback entirely. As a result, the CN is never evaluated against the dNSName name constraint, and an out-of-scope CN is accepted.

This is a classic incomplete-fix scenario. The original vulnerability, CVE-2026-6731, likely addressed a case where the CN fallback was missing or incorrectly implemented. The fix introduced in wolfSSL 5.9.2 attempted to add the CN-as-DNS fallback but used an overly broad condition that failed to account for certificates with non-dNSName SANs. The result is a bypass of the name-constraint check that is both subtle and dangerous, as it occurs during the certificate validation process, which is foundational to TLS trust.

The attack surface is any wolfSSL client or server that performs certificate chain validation with name constraints enabled. This includes TLS clients validating server certificates, mutual TLS (mTLS) scenarios where client certificates are validated, and any application using wolfSSL to verify certificate chains against a constrained CA. The vulnerability is not remotely triggerable without a certificate signed by a constrained CA, but in scenarios where an attacker can obtain such a certificate (e.g., from a subordinate CA that has been compromised or misconfigured), the flaw allows the attacker to present a certificate with an out-of-scope CN that would otherwise be rejected.

Exploitation Scenarios

Reconnaissance and Target Identification An attacker first identifies a target application or service that uses wolfSSL 5.9.2 for TLS certificate validation and that trusts a CA with name constraints. This could be a TLS client connecting to an attacker-controlled server, an mTLS endpoint, or any application where certificate validation is performed. The attacker must be able to obtain a certificate from a CA that is under the same name-constraint hierarchy as the trusted CA.

Triggering the Vulnerability The attacker obtains or crafts a certificate that meets the following conditions:

• It is issued by a CA whose name constraints restrict dNSName to a specific subtree.
• The certificate contains at least one SAN entry of a type other than dNSName (e.g., registeredID or iPAddress), so that altNames is non-NULL.
• The certificate has no dNSName SAN.
• The certificate's Subject Common Name (CN) contains a DNS name that is outside the permitted dNSName subtree.
• The certificate is not a CA certificate (!cert->isCA).

When the wolfSSL library validates this certificate chain, it should reject the certificate because the CN (used as a fallback DNS name) is out of scope. However, due to the flawed gating condition, the CN is never checked against the dNSName name constraint, and the certificate is accepted.

Payload and Execution The exploitation is passive from a code-execution perspective: the attacker simply presents the crafted certificate during a TLS handshake. If the target uses wolfSSL 5.9.2 and validates the chain, the handshake succeeds despite the name-constraint violation. The attacker does not need to inject code or exploit memory corruption; the vulnerability is a logic flaw in certificate validation. No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Post-Exploitation Impact Once the certificate is accepted, the attacker can impersonate a service or user with a DNS name that should be out of scope for the constrained CA. In a TLS client scenario, this enables a man-in-the-middle (MitM) attack against connections to that DNS name, allowing the attacker to decrypt, modify, or redirect traffic. In an mTLS scenario, the attacker could gain unauthorized access to a protected resource by presenting a client certificate with an out-of-scope CN. The blast radius depends on what the target application does after certificate validation: it could range from data exposure to full authentication bypass.

Impact Assessment

The vulnerability undermines the trust model of X.509 name constraints, which are a critical part of the CA/Browser Forum baseline requirements and enterprise PKI designs. The primary impact is a bypass of a security control that is intended to prevent a compromised or misissued subordinate CA from issuing certificates for domains outside its permitted scope. In practical terms, an attacker who can obtain a certificate from a constrained CA (e.g., through a compromised intermediate CA) can use that certificate to impersonate any DNS name, even if the CA's name constraints were meant to limit its authority.

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects a network-exploitable vulnerability with high attack complexity (AC:H) because the attacker must obtain a specially crafted certificate from a constrained CA. There is no required privilege (PR:N) and no user interaction (UI:N). The scope is unchanged (S:U), while confidentiality and integrity impacts are high (C:H/I:H) because successful exploitation can lead to MitM and impersonation. Availability impact is none (A:N).

Business impact includes potential data breaches, unauthorized access to internal services, and erosion of trust in TLS-based communications. Organizations that rely on name constraints for segmentation or regulatory compliance (e.g., in financial services or government) are at higher risk. The affected systems are any that use wolfSSL 5.9.2 or later versions that contain the incomplete fix, including IoT devices, embedded systems, and enterprise applications that use wolfSSL as their TLS library.

Detection Guidance

Sigma Rule

title: wolfSSL Name Constraint Bypass via Non-dNSName SAN Certificate
id: 8f4a2c1e-9b7d-4e3a-8c2f-1a5d6e7f8a9b
status: experimental
description: Detects TLS certificate validation events where a certificate with a non-dNSName SAN and an out-of-scope CN is accepted, indicating exploitation of CVE-2026-89134 in wolfSSL.
author: Threat Intelligence Team
date: 2026-05-15
logsource:
  product: wolfssl
  service: certificate_validation
detection:
  selection:
    event: "certificate_validated"
    validation_result: "success"
    cert_has_dns_san: false
    cert_has_other_san: true
    cert_cn_out_of_scope: true
    cert_is_ca: false
  condition: selection
falsepositives:
  - Legitimate certificates that use CN as a fallback and are within scope (should not match due to out_of_scope condition)
level: high
tags:
  - attack.defense_evasion
  - attack.t1553
  - cve.2026-89134

YARA Rule

rule CVE_2026_89134_wolfSSL_NameConstraint_Bypass
{
    meta:
        description = "Detects wolfSSL versions 5.9.2 and later that contain the incomplete fix for CVE-2026-6731, leading to CVE-2026-89134"
        author = "Threat Intelligence Team"
        date = "2026-05-15"
        cve = "CVE-2026-89134"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-89134"
    strings:
        $s1 = "subjectCN != NULL && altNames == NULL && !isCA" ascii
        $s2 = "wolfSSL" ascii
        $s3 = "5.9.2" ascii
    condition:
        $s2 and $s3 and $s1
}

Suricata IDS Rule

alert tls any any -> any any (msg:"CVE-2026-89134 wolfSSL Name Constraint Bypass Attempt"; flow:to_server,established; tls.subject_cn; content:"!"; pcre:"/subjectCN.*altNames.*isCA/"; tls.cert_san; content:"!"; pcre:"/registeredID|iPAddress/"; sid:1000001; rev:1; reference:cve,2026-89134; classtype:attempted-recon;)

Elastic Detection

sequence by host.id with maxspan=5m
  [process where event.type == "start" and process.name == "wolfssl"] by host.id
  [network where event.type == "connection" and network.protocol == "tls" and tls.server.certificate.subject.common_name != null and tls.server.certificate.san.dns == null] by host.id

Splunk SPL Query

index=proxy OR index=network sourcetype=tls:certificate
| where match(certificate_san, "registeredID|iPAddress") AND isnull(certificate_san_dns) AND certificate_cn!=""
| lookup name_constraints_lookup cn AS certificate_cn OUTPUT constraint_scope
| where constraint_scope="out_of_scope"
| stats count by src_ip, dest_ip, certificate_cn, certificate_issuer
| where count > 0

Wazuh OSSEC Rule

<group name="wolfssl,certificate_validation,">
  <rule id="100100" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">certificate_validated</field>
    <field name="validation_result">success</field>
    <field name="cert_has_dns_san">false</field>
    <field name="cert_has_other_san">true</field>
    <field name="cert_cn_out_of_scope">true</field>
    <field name="cert_is_ca">false</field>
    <description>CVE-2026-89134: wolfSSL name constraint bypass detected - certificate with non-dNSName SAN and out-of-scope CN accepted.</description>
    <mitre>
      <id>T1553</id>
    </mitre>
    <group>cve_2026_89134,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Disable the use of CN as a fallback for DNS name-constraint checks in wolfSSL configurations, if the library exposes a compile-time or runtime option. This is a workaround only and may not be available in all deployments.
   • Where possible, avoid using CAs that impose name constraints with dNSName restrictions until a patch is available, or switch to a different TLS library (e.g., OpenSSL, mbedTLS) that correctly implements name-constraint validation.
   • Implement additional certificate validation checks at the application layer, such as manually verifying that the certificate's CN or SANs match the expected DNS name and that the issuing CA's name constraints are respected. This is complex and error-prone.
   • Monitor for anomalous certificate acceptance events using the detection rules above.

2. Patch/Upgrade Steps:

   • No vendor patch is available at the time of reporting. Monitor wolfSSL's official security advisories and release notes for a fixed version. Once a patch is released, upgrade to the patched version immediately.
   • If using a package manager or vendor distribution, check for backported fixes and apply them as they become available.
   • Until a patch is available, consider the risk assessment for each deployment and prioritize systems that rely on name constraints for security segmentation.

3. Long-Term Hardening:

   • Implement a robust certificate validation policy that does not rely solely on CN fallback for DNS name checks; require explicit dNSName SANs for all certificates used in TLS.
   • Enforce strict name constraints in CA hierarchies and regularly audit subordinate CAs for compliance.
   • Use certificate transparency (CT) monitoring to detect misissued certificates that could be used to exploit this flaw.
   • Adopt a defense-in-depth approach: combine certificate validation with additional identity checks, such as pinned certificates or public key pinning for critical connections.
   • Keep TLS libraries up to date and subscribe to security advisories for wolfSSL and other cryptographic libraries.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89134
• CVE-2026-6731 (previous incomplete fix): https://nvd.nist.gov/vuln/detail/CVE-2026-6731
• wolfSSL Security Advisories: https://www.wolfssl.com/security/
• CWE-295: Improper Certificate Validation: https://cwe.mitre.org/data/definitions/295.html
• CISA KEV Catalog: Not applicable (CVE not listed in KEV as of reporting).