VULNpocalypse
CriticalVulnerabilityPatch available

Embedthis GoAhead 6.1.1 (CVE-2026-115881, CVE-2026-115884): revoked client certificates accepted, plus a password bypass

GoAhead up to 6.1.0 ignores its CRL, so revoked mTLS client certificates still log in. Rebuild firmware with GoAhead 6.1.1; device owners need vendor updates.

Published
Updated
Fixed in
GoAhead 6.1.1
Exploitation
No exploitation reported as of 27 October 2026 (The Hacker News); proof-of-concept code published by FoxIO

What happened

GoAhead is a small embedded web server. Embedthis says it runs in hundreds of millions of devices, and names users including HP, Oracle, Siemens, Canon, Rockwell, D-Link and Comcast (The Hacker News). None of those vendors has been shown to use an affected backend or setting.

GoAhead 6.1.1 went to device makers on 2 August 2026. The advisories became public on 12 October. It fixes 11 advisories, three of them critical, plus 31 defects from an internal audit (GoAhead 6.1.1 release). On 26 October, Sebastien Fery of FoxIO published details of three TLS bugs, each tied to a different TLS library (FoxIO).

OpenSSL backend: CRL never checked (CVE-2026-115881, CVSS 9.1). In sslOpen() in src/openssl.c, GoAhead loads the CRL with X509_STORE_load_locations but never calls X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK). Without that flag OpenSSL skips revocation entirely. The load succeeds and nothing is logged. Affected: GoAhead 3.4.5 to 6.1.0 built with OpenSSL, with peer verification on, a CA bundle, issuer checking on and a CRL configured. The attacker needs a certificate signed by a trusted CA that has been revoked, for example one from a lost device or a former employee (GitHub advisory).

LibreSSL legacy verifier: over-long chains accepted (CVE-2026-115884, CVSS 7.4). On GoAhead 6.1.0 and earlier with LibreSSL 3.2.x or 3.3.2 to 3.3.6, client certificates required and issuer checking off, a chain longer than GoAhead’s 10-certificate limit is accepted. The attacker can finish the handshake as an authenticated client without a trusted key (The Hacker News). OpenSSL, BoringSSL, AWS-LC and LibreSSL 4.x builds are not exposed (FoxIO).

Mbed TLS backend: 1-byte DH value (no CVE, CVSS 5.9). GoAhead 4.0.2 to 6.1.0 on Mbed TLS sends a one-byte Diffie-Hellman modulus instead of 2,048 bits, so a passive observer can decrypt TLS 1.2 DHE_RSA sessions. Only clients without a minimum-size check accept it. OpenSSL, current Go, current Java and mainstream browsers reject it. ECDHE and TLS 1.3 are not affected (FoxIO).

The same release fixes a login bypass. If a user’s stored password uses the Blowfish (BF1:) format, any password logs that user in through Basic or form login (GOAHEAD-SA-2026-0001, critical) (GoAhead 6.1.1 release). The Blowfish format arrived in 6.1.0, and Embedthis says form login is the default for its built-in administration pages (The Hacker News). The third critical advisory is command injection through Windows .bat CGI scripts (GOAHEAD-SA-2026-0007).

No attacks have been reported. FoxIO has published proof-of-concept code (The Hacker News). The two CVE IDs were not yet published in the CVE list on 2 November (CVE API), so scanners keyed on CVE records may not flag them yet.

Am I affected?

If you build with GoAhead, check the version you vendor and your build settings. CVE-2026-115881 needs all of these (GitHub advisory):

bash
# In your GoAhead source tree or build configuration
grep -rnE 'ME_COM_OPENSSL|ME_GOAHEAD_SSL_VERIFY_PEER|ME_GOAHEAD_SSL_VERIFY_ISSUER|ME_GOAHEAD_SSL_AUTHORITY|ME_GOAHEAD_SSL_REVOKE|ME_COM_MBEDTLS' .
  • ME_COM_OPENSSL=1, ME_GOAHEAD_SSL_VERIFY_PEER=1, ME_GOAHEAD_SSL_VERIFY_ISSUER=1, and non-empty ME_GOAHEAD_SSL_AUTHORITY and ME_GOAHEAD_SSL_REVOKE: exposed to CVE-2026-115881.
  • LibreSSL 3.2.x or 3.3.2 to 3.3.6 with VERIFY_PEER=1 and VERIFY_ISSUER=0: exposed to CVE-2026-115884.
  • ME_COM_MBEDTLS=1 with DHE cipher suites enabled: exposed to the DH bug.
  • Any 6.1.0 build that stores BF1: password hashes: exposed to the login bypass.

If you own devices, you usually cannot see the GoAhead version. Ask each vendor directly whether the device embeds GoAhead, which TLS backend it uses, and when firmware with 6.1.1 ships. FoxIO publishes JA4S and JA4Scan fingerprints that identify GoAhead servers by backend, and a sample query for spotting DHE suites from GoAhead devices in JA4S logs (FoxIO).

What to do now

  1. Rebuild with GoAhead 6.1.1 and ship firmware. Embedthis calls it a drop-in replacement for 6.1.0 (GoAhead 6.1.1 release).
  2. After upgrading, end active sessions or restart the server, and have users with BF1 hashes change their passwords. Embedthis recommends both. Hashes made by calling websMakePassword() directly must be regenerated with gopass.
  3. Until devices are patched, do not trust CRL revocation on GoAhead-based devices that use OpenSSL. Revoking a certificate does nothing. To cut off a lost or stolen client certificate, restrict access to the device’s management interface by network instead, or replace the issuing CA.
  4. LibreSSL builds: set VERIFY_ISSUER=1 with a trusted CA bundle, or move to OpenSSL or LibreSSL 4.x (FoxIO).
  5. Mbed TLS builds: disable finite-field DHE suites or switch to the OpenSSL backend if you cannot ship 6.1.1 yet.
  6. Windows builds: 6.1.1 stops running .bat and .cmd CGI scripts. Wrap that logic in a small .exe before upgrading.

Sources