CVE-2026-6091: wolfSSL Partial-Chain Certificate Verification Bypass

Technical summary

CVE-2026-6091 exists in wolfSSL's OpenSSL compatibility layer, specifically in the wolfSSL_X509_verify_cert and X509_STORE path-building logic (activated via the OPENSSL_EXTRA compile flag). When the X509_V_FLAG_PARTIAL_CHAIN verify flag is set, the certificate verification routine fails to enforce that the chain must terminate at a trusted anchor certificate. Instead, it accepts chains ending at peer-supplied intermediate certificates, violating the fundamental principle that all certificate chains must resolve to a trusted root. The issue is classified as CWE-295 (Improper Certificate Validation), and exploitation requires network access and low-privileged context. An attacker can present a crafted chain with a self-controlled intermediate at the terminus, and the verification function will incorrectly validate it as trustworthy.

Business impact

For organizations deploying wolfSSL in TLS/SSL endpoints, API gateways, or embedded systems that rely on certificate-based mutual authentication, this vulnerability degrades the integrity of identity verification. An authenticated but unprivileged attacker could perform man-in-the-middle attacks or service impersonation without obtaining a certificate from a legitimate Certificate Authority. In regulated industries (finance, healthcare, critical infrastructure) where certificate validation is a control, this flaw could violate compliance requirements and undermine audit trails. The practical impact depends on whether partial-chain verification is explicitly enabled; default configurations may be unaffected.

Affected systems

wolfSSL versions affected by this vulnerability are those compiled with the OPENSSL_EXTRA compatibility layer and where the X509_V_FLAG_PARTIAL_CHAIN flag is utilized in certificate verification logic. Typically this affects embedded TLS implementations, IoT devices, and applications that adopted wolfSSL as a lightweight alternative to OpenSSL. Organizations should verify which versions of wolfSSL they deploy and whether OPENSSL_EXTRA is enabled in their build configurations. Patch guidance from wolfSSL should specify affected version ranges.

Exploitability

Exploitation requires network-level access (AV:N) and the attacker must have some level of authentication or privilege on the system (PR:L). User interaction is not required. However, the attacker must craft a certificate chain and either control network routing to that service or be in a position to influence which certificate chains are presented during a TLS handshake. The vulnerability is most readily exploitable in scenarios where an attacker operates a peer service in a mutual-TLS environment or compromises network routing. The CVSS score of 6.5 (MEDIUM) reflects high integrity impact but limited availability or confidentiality consequences.

Remediation

Apply a patched version of wolfSSL released by the vendor that corrects the certificate chain validation logic to enforce termination at a trusted anchor, even when partial-chain verification is enabled. Organizations should verify the exact patched version against the official wolfSSL security advisory. As an interim measure, audit whether X509_V_FLAG_PARTIAL_CHAIN is truly necessary for your deployment; disabling it may mitigate the risk pending patch application. For systems where wolfSSL is compiled into a firmware or embedded product, coordinate with your OEM for a patched firmware release.

Patch guidance

Check the wolfSSL official security advisory and GitHub repository for the patched version number and release date. Updates should be validated and staged in a non-production environment first, as certificate validation changes can be sensitive. Verify that after patching, your certificate chain validation still works as intended for legitimate use cases. If OPENSSL_EXTRA is optional, confirm it remains enabled only if your application genuinely requires OpenSSL compatibility.

Detection guidance

Monitor for failed certificate verification attempts or unusual certificate chain presentations in TLS handshake logs. Flag any instances where authentication succeeds with certificates terminating at non-standard intermediate CAs. Use network traffic analysis tools (Wireshark, Suricata) to inspect certificate chains in TLS_CERTIFICATE messages. Security Information and Event Management (SIEM) systems should correlate unusual certificate verification patterns with other authentication anomalies. Validate certificate chains in your applications using certificate pinning or strict path verification policies.

Why prioritize this

Although not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability merits prompt attention because it directly undermines certificate-based authentication integrity. Any system relying on mutual TLS or certificate pinning should be prioritized for patching. Organizations in regulated sectors with strict identity verification controls should treat this as higher priority. The attack requires low privilege but threatens a fundamental security primitive (certificate trust).

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects: Network-accessible attack surface (AV:N), low attack complexity with no special conditions required (AC:L), low privilege required (PR:L), no user interaction needed (UI:N), and impact scoped to the vulnerable component (S:U). Integrity is highly impacted (I:H) because the core trust model is violated, but confidentiality and availability are not directly compromised (C:N, A:N). The severity is not CRITICAL because exploitation is bounded to scenarios where partial-chain verification is enabled and the attacker has some level of authentication context.

Frequently asked questions