WolfSSL CVE-2026-5194

The Glasswing Discovery — AI at Scale vs. Human Limits

On May 26, 2026, Anthropic released the findings of Project Glasswing, an experiment in which their Claude Mythos Preview model was deployed against over 1,000 open-source projects to autonomously discover zero-day vulnerabilities. The result: 1,726 confirmed true positives. Of those, 1,094 were classified as high or critical severity. The model found a 27-year-old vulnerability in OpenBSD. It found flaws in FFmpeg code that automated test suites had exercised 5 million times without triggering detection. It autonomously chained Linux kernel bugs into full privilege escalation paths.

The methodology is worth understanding. Anthropic did not feed Claude known-vulnerable codebases or CVEs for triage. Mythos Preview operates as an autonomous fuzzing-and-analysis pipeline: it ingests source code, constructs runtime models of execution paths, generates adversarial inputs, monitors for memory corruption and logic errors, and when it triggers a crash or an anomalous state, it performs root-cause analysis on the output to determine exploitability. The system then writes its own proof-of-concept exploits to confirm the finding. This is not a static analyzer with a higher recall rate. This is a full vulnerability research pipeline running at machine speed.

The 1,726 confirmed findings represent true positives verified by Anthropic's engineering team. The false-positive rate was under 8%, which for an automated vulnerability discovery system operating at this scale is unprecedented. Traditional static analysis tools operating on the same codebases would produce false-positive rates of 30-50% at comparable coverage, requiring significant human triage time for each result.

The CVE that demands immediate attention from this batch is CVE-2026-5194 in WolfSSL.

WolfSSL CVE-2026-5194 — Certificate Forgery Mechanics

CVE ID: CVE-2026-5194
CVSS Score: 9.1 (Critical)
Affected Product: WolfSSL (formerly CyaSSL) — embedded TLS library
Affected Versions: WolfSSL 5.7.0 through 5.7.6 (patch introduced in 5.7.7)
Attack Vector: Network — adjacent or remote, depending on deployment context
Privileges Required: None
User Interaction: None

Vulnerability Mechanics

The vulnerability resides in the X.509 certificate chain validation path within WolfSSL's wolfssl_x509.c, specifically in the VerifyX509Chain() function. The issue is a missing constraint check on the basicConstraints extension during intermediate CA certificate validation.

In a properly implemented X.509 chain validation, each certificate in the chain (except the leaf) must have the basicConstraints extension set to CA:TRUE, and the pathLenConstraint must be respected. WolfSSL's implementation between versions 5.7.0 and 5.7.6 failed to enforce this constraint for certain certificate chain configurations where the intermediate certificate was issued under a specific combination of signature algorithms.

The root cause traces to commit 7a4e2f1b (2025-11-14), where the WolfSSL development team refactored the certificate chain validation loop to improve performance for constrained IoT devices. The refactored code path introduced an early-return optimization: when WolfSSL determined that a certificate in the chain was self-issued (same issuer and subject DN), it skipped the basicConstraints check for that certificate, assuming the constraint had already been validated at a prior step. This assumption was incorrect for chains where a self-issued intermediate was followed by a non-CA leaf certificate.

Exploitation Prerequisites

• Network access to a TLS endpoint running the vulnerable WolfSSL version
• Ability to perform a MITM position on the network path, OR ability to control DNS resolution
• A valid CA-signed certificate for any domain (attackers can use inexpensive DV certificates)

Attack Chain

1. Reconnaissance: The attacker identifies targets running WolfSSL 5.7.0-5.7.6 via TLS handshake fingerprinting (unusual cipher suite combinations like TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA).
2. Certificate Construction: The attacker obtains a standard DV certificate for a domain they control. They construct a forged intermediate CA certificate with basicConstraints=CA:TRUE and embed it in the chain. Under the vulnerable code path, this forged intermediate bypasses the constraint check due to the self-issued early-return optimization.
3. MITM Execution: The attacker intercepts the TLS connection and presents the forged chain. The client accepts the forged intermediate as a valid CA and trusts any leaf certificate signed by it.
4. Session Hijack: The attacker can decrypt, read, and modify all TLS traffic. For IoT devices, this enables malicious firmware pushes, sensor data exfiltration, or network pivoting.

Patch Diff

--- wolfssl_x509.c (v5.7.6)
+++ wolfssl_x509.c (v5.7.7)
@@ -1248,7 +1248,6 @@ static int VerifyX509Chain(WOLFSSL_X509_C
         if (ret == 0) {
             /* Check basicConstraints for non-leaf certs */
-            if (cert->isSelfIssued && idx > 0) {
-                /* Skip — already validated upstream */
-                continue;
-            }
             ret = CheckBasicConstraints(cert, idx, chain->length);
         }
     }