CVE-2026-93302

Executive Summary

CVE-2026-93302 is a certificate validation bypass in the wolfSSL TLS/DTLS library affecting builds that enable the WOLFSSL_TRUST_PEER_CERT macro and load CA certificates via wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). The MatchTrustedPeer logic ignores the public key used during peer verification, allowing a malicious (D)TLS server (or client, in mutual authentication) to present a forged CA clone certificate that passes authentication. This affects widely deployed autoconf-based integrations including nginx, haproxy, stunnel, wpa_supplicant, Apache httpd, hitch, BIND, rsyslog, and ffmpeg, exposing any deployment relying on peer certificate trust for authentication integrity.

Technical Analysis

The vulnerability resides in wolfSSL's trusted-peer-certificate verification path. When WOLFSSL_TRUST_PEER_CERT is defined and CA certificates are supplied through wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(), the internal MatchTrustedPeer routine is responsible for matching an incoming peer certificate against the configured trusted-peer set. Per the NVD description, MatchTrustedPeer ignores the public key used, meaning the verification compares peer identity without binding the check to the expected public key material. As a result, a forged certificate that mimics the trusted CA (a "forged CA clone") passes verification despite not possessing the legitimate key pair.

Two build characteristics widen the attack surface:

1. WOLFSSL_TRUST_PEER_CERT enabled — activates the trusted-peer-certificate code path (CWE-295, Improper Certificate Validation).
2. OPENSSL_COMPATIBLE_DEFAULTS defined — broadens the affected API to include all CA certificate loading, not just the two explicit trust-peer APIs. This is the default in autoconf builds used by nginx, haproxy, stunnel, wpa_supplicant, Apache httpd, hitch, BIND, rsyslog, ffmpeg, and generic/distribution "all" builds.

The precondition for exploitation is that the attacker must know which CA certificates the victim client (or server, in mutual-auth scenarios) has loaded. The description states the peer must know the certificates being loaded into either trust API. Because CA bundles are frequently public (Mozilla NSS bundle, OS trust stores, vendor CA lists) or fingerprinted through network reconnaissance, this precondition is often trivially satisfied. The failure is fundamentally a validation logic defect: identity/trust matching proceeds without cryptographically binding the presented certificate to the expected public key, so a cloned CA certificate chains successfully.

No code-level function bodies, memory-safety primitives, or parameter names beyond those in the description are available; the defect is a certificate-validation logic flaw, not a memory-corruption issue. CWE-295 (Improper Certificate Validation) is the applicable class. Exploitation requires a network-reachable (D)TLS endpoint and knowledge of the trusted CA set — no user interaction, no prior authentication.

Exploitation Scenarios

No public PoC is available for CVE-2026-93302; the following attack chain is inferred from the vulnerability class (certificate validation bypass) and the specifics stated in the NVD description.

1. Reconnaissance / target identification. The adversary identifies a target service that uses a wolfSSL build compiled with WOLFSSL_TRUST_PEER_CERT (and, for the broader API coverage, OPENSSL_COMPATIBLE_DEFAULTS) and that relies on wolfSSL_CTX_trust_peer_cert() / wolfSSL_trust_peer_cert() for authenticating peers. The adversary fingerprints the (D)TLS server or determines the client use case (e.g., stunnel/haproxy client mode, wpa_supplicant supplicant, hitch/BIND TLS termination) and enumerates or guesses which CA certificates the peer has loaded — a precondition explicitly noted in the description ("The peer must know the certificates being loaded").

2. Triggering the flaw class. The adversary forges a certificate that clones a CA the victim trusts (a "forged CA clone") without holding the genuine CA private key. Because MatchTrustedPeer ignores the public key used, the peer-verification routine accepts the forged clone as if it were the legitimate CA. In a standard (D)TLS handshake, the malicious server presents this forged CA clone during certificate exchange; the client's verification path treats it as trusted.

3. Payload / execution at the vulnerability-class level. This is an authentication-bypass class exploit, not code execution: no injected payload is required. The adversary completes the (D)TLS handshake as an impersonated trusted peer, enabling session establishment that should have been rejected. In mutual-authentication flows, the roles invert — a malicious client impersonating a CA the server trusts can authenticate to the server.

4. Post-exploitation impact. Successful bypass grants the adversary an authenticated (D)TLS session as a trusted peer, defeating confidentiality and integrity guarantees of the channel and enabling man-in-the-middle interception, credential or data exfiltration, and impersonation of legitimate infrastructure endpoints. The realistic blast radius spans all services using the affected verification APIs with attacker-known CA sets.

Impact Assessment

CVSS score is N/A in the provided data; no vector is published. Based on the mechanism, the practical impact is High for Confidentiality and Integrity and materially High for Authentication (mitigating factor: the attack requires knowledge of the trusted CA set, i.e., Attack Complexity: High). The affected population includes any autoconf-built deployment of the listed software (nginx, haproxy, stunnel, wpa_supplicant, Apache httpd, hitch, BIND, rsyslog, ffmpeg) where WOLFSSL_TRUST_PEER_CERT and OPENSSL_COMPATIBLE_DEFAULTS are defined and peer authentication is relied upon. Blast radius includes: (a) server-side TLS termination that expects client certificate authentication; (b) client-side TLS where forged server identities are accepted; (c) DTLS use cases where mutual authentication is enforced. Business impact centers on trust-boundary failure: any workflow relying on certificate-based identity — VPN/overlay access, mTLS API gateways, federation, secure log shipping, and network ingress — can be impersonated by an attacker who knows the CA bundle. CISA KEV status: NO; EPSS is not yet scored by FIRST.org, so no exploitation-probability estimate is available. No public exploit code or Nuclei template is known at this time.

Detection Guidance

Sigma Rule

title: Potential wolfSSL Forged CA Clone Peer Authentication Bypass
id: 7b7c9f01-1a2b-4c3d-9e4f-2d6a7b8c9d01
status: experimental
description: Detects indicators of forged CA clones or wolfSSL trust-peer configuration in logs (CVE-2026-93302).
logsource:
  product: linux
  service: syslog
detection:
  selection_cert:
    - 'x509 verify.*error'
    - 'certificate verify failed'
    - 'trust_peer'
    - 'unknown ca'
  selection_ssl:
    - 'TLS handshake'
    - 'accept peer'
    - 'certificate fingerprint mismatch'
  condition: selection_cert and selection_ssl
falsepositives:
  - Legitimate certificate rotation events
level: medium
tags:
  - attack.t1190
  - cve.2026.93302

YARA Rule

rule CVE_2026_93302_wolfSSL_TrustPeer
{
    meta:
        description = "Detects wolfSSL builds referencing the vulnerable/affected trust-peer APIs and macros (CVE-2026-93302)"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93302"
        hash = "unknown"
    strings:
        $a = "WOLFSSL_TRUST_PEER_CERT"
        $b = "wolfSSL_CTX_trust_peer_cert"
        $c = "wolfSSL_trust_peer_cert"
        $d = "MatchTrustedPeer"
        $e = "OPENSSL_COMPATIBLE_DEFAULTS"
    condition:
        uint32be(0) != 0 and 2 of ($a, $b, $c, $d, $e)
}

Suricata IDS Rule

alert tls any any -> any any (msg:"CVE-2026-93302 wolfSSL possible forged CA clone peer authentication bypass"; flow:established; tls.store; classtype:attempted-user; reference:cve,2026-93302; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93302; sid:202693302; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5m
  [ process where process.name in ("nginx","haproxy","stunnel","apache2","httpd","named","rsyslogd","ffmpeg","wpa_supplicant","hitch") and
      (process.command_line : "*WOLFSSL_TRUST_PEER_CERT*" or process.command_line : "*trust_peer_cert*") ]
  [ network where network.transport in ("tcp","udp") and tls.server.certificate_chain : "*" and tls.client.verified == "false" ]

Splunk SPL Query

index=* sourcetype=syslog (wolfssl OR wolfSSL OR stunnel OR haproxy OR nginx)
| search ("trust_peer_cert" OR "WOLFSSL_TRUST_PEER_CERT" OR "MatchTrustedPeer" OR "certificate verify failed" OR "forged" OR "unknown CA")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process, message
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="wolfssl,cve-2026-93302,">
  <rule id="100302" level="8">
    <decoded_as>syslog</decoded_as>
    <field name="message">WOLFSSL_TRUST_PEER_CERT|trust_peer_cert|MatchTrustedPeer</field>
    <description>CVE-2026-93302: wolfSSL trusted-peer certificate configuration referenced in log</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100303" level="10">
    <decoded_as>syslog</decoded_as>
    <field name="message">certificate verify failed|unknown CA|forged</field>
    <description>CVE-2026-93302: possible forged CA clone / certificate verification anomaly</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Per the NVD description, rebuild with the configure flag --disable-openssl-compatible-defaults and do not load CA certificates using wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). Removing these calls eliminates reliance on the defective MatchTrustedPeer trust path. Where trusted-peer functionality is required for authentication, avoid reliance on attacker-knowable CA bundles until a fix is applied.
2. Patch/upgrade steps. As no vendor patch is currently tracked (Patch Sources: []), the vendor-supplied options are: update to the latest wolfSSL version, or apply the fix patch if/when published. Verify the wolfSSL version in use across all listed autoconf build consumers (nginx, haproxy, stunnel, wpas, apache httpd, hitch, bind, rsyslog, ffmpeg) and inventory which have WOLFSSL_TRUST_PEER_CERT compiled in. Monitor the vendor advisory for an assigned patch release.
3. Long-term hardening. Replace the peer-trust API pattern with a full chain-and-key verification model that binds the presented certificate to the expected public key. Pin expected CA public keys or certificate fingerprints rather than trusting a broad, publicly knowable CA set. Restrict egress and ingress to reduce the attack surface for impersonated trusted endpoints, and add continuous detection (rules above) for verification anomalies and trust-peer configuration drift. Track CISA KEV and FIRST EPSS for future scoring on CVE-2026-93302.

References

• NVD — CVE-2026-93302: https://nvd.nist.gov/vuln/detail/CVE-2026-93302
• CWE-295 — Improper Certificate Validation: https://cwe.mitre.org/data/definitions/295.html
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• wolfSSL project (vendor source and security advisories): https://www.wolfssl.com/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or Nuclei template is known for CVE-2026-93302. No named threat actor campaigns or exploit-in-the-wild evidence are available in the provided intelligence. EPSS has not been scored by FIRST.org and CVE-2026-93302 is not listed in CISA KEV.