CVE-2026-89136

creationtimestamp| type| source ---|---|--- 2026-09-27 10:28:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jzlmooh4jfqzb 2026-09-27 12:00:40+00:00| seen| https://gist.github.com/ichintu/295c47a4fdd1542fe1dda3872969c6bd...

CVE-2026-89136

When using RPK Raw Public Key, the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited servercerttype=RawPublicKey which allowed a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in --enable-rpk OR --enable-all OR...