GoAhead web server · Disclosed

GoAhead Accepts Revoked Certificates; Public PoC, Fixes Depend on Manufacturers

Oct 27, 2026 · 2 min read

FoxIO disclosed three TLS flaws in GoAhead, an embedded web server present, according to the firm, on hundreds of millions of IoT, OT, firewall and military devices. The critical flaw (CVE-2026-115881, CVSS 9.1) makes OpenSSL builds with mutual TLS accept revoked client certificates, and proof-of-concept code is public. Version 6.1.1 fixes the server, but device patches depend on each manufacturer.

By HIFY Radar newsroom Updated 10/29/2026 06:07 AM Get this every day →← Back to the feed 6 sources

HighVulnerabilityDisclosedFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

FoxIO disclosed three TLS flaws in GoAhead, a server used in management interfaces of routers, printers, gateways and industrial equipment. The most severe flaw makes the server accept already revoked digital certificates, so a stolen device can keep its access. A server fix exists, but device patches depend on each manufacturer.

Why it matters

In mutual TLS setups, a revoked certificate, such as one tied to a stolen device, is still accepted, and nothing at startup warns that revocation checking is inactive. A second error allows recorded TLS 1.2 sessions to be decrypted on Mbed TLS builds. According to FoxIO, Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin and Boeing use the server, with no specification of which products are affected.

What to do

Inventory devices running GoAhead and identify the TLS library and certificate configuration, using the fingerprints FoxIO published. Pressure manufacturers for firmware with version 6.1.1, since the upstream fix does not guarantee a device patch. Meanwhile, apply mitigations: disable finite-field DHE cipher suites on Mbed TLS and enable issuer verification with a trusted CA on LibreSSL.

For the technical team

CVE: CVE-2026-115881
Affected: GoAhead web server, usado por Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, · CVE-2026-115881: GoAhead 3.4.5 through 6.1.0 with an OpenSSL-compatible backend and a configured CRL. GOAHEAD-SA-2026-0005: GoAhead 4.0.2 through 6.1.0 with Mbed TLS when TLS 1.2 DHE_RSA is negotiated with a permissive client. CVE-2026-115884: GoAhead up to 6.1.0 built with LibreSSL 3.2.x or 3.3.2 through 3.3.6.
Exploitation: Public proof-of-concept code released by FoxIO, which also published fingerprints to identify internet-facing GoAhead servers and their TLS library. No in-the-wild exploitation reported in the sources.
Fix: GoAhead 6.1.1, released on Aug 2, resolves the OpenSSL and Mbed TLS issues, according to SecurityWeek; DarkWebInformer says all three were fixed in 6.1.1. For LibreSSL, FoxIO recommends enabling issuer verification with a trusted CA bundle or switching to OpenSSL or LibreSSL 4.x. For Mbed TLS, turn off finite-field DHE cipher suites or move to the OpenSSL backend. Device patches depend on the manufacturer.
Vector: Three flaws in GoAhead's integration with TLS libraries. CVE-2026-115881: on builds with an OpenSSL-compatible backend and mutual TLS with a certificate revocation list (CRL), the server loads the CRL via X509_STORE_load_locations but never enables the X509_V_FLAG_CRL_CHECK flag; a revoked client certificate passes authentication even with VERIFY_PEER=1 and VERIFY_ISSUER=1. GOAHEAD-SA-2026-0005 (Mbed TLS): using sizeof(dhm_g) instead of sizeof(dhm_p) makes Mbed TLS read only the first byte (0xFF) of the intended 256-byte, 2048-bit DH modulus, leaving eight possible shared secrets in a TLS 1.2 DHE_RSA handshake; a passive observer who captured the session can decrypt it. CVE-2026-115884: certificate chain-depth limit bypass in the LibreSSL legacy verifier, only against servers that require client certificates but accept them from any issuer.
More details: Discovered and disclosed by Sébastien Féry of FoxIO; advisories published on Oct 12. The Mbed TLS flaw is a 2018 typo, according to FoxIO. None of the flaws prevents the affected handshake from completing. The tested OpenSSL client rejected the malformed DH parameters; ECDHE and TLS 1.3 are unaffected. Nothing at startup warns that revocation checking is inactive. FoxIO did not specify whether any products from the named companies use a vulnerable configuration.

Timeline

10/29/2026 06:07 AM
Disclosure by researcher Sébastien Féry of FoxIO details the three GoAhead TLS flaws: acceptance of revoked client certificates, traffic decryption, and certificate chain-depth bypass, with impact varying by TLS backend and verification settings on each device.
10/28/2026 12:18 PM
New post details the flaw: CVSS 9.1, affected versions 3.4.5 through 6.1.0, and a root cause in which GoAhead loads the revocation list but never enables the OpenSSL flag that enforces it.
10/28/2026 10:15 AM
SecurityWeek coverage of the FoxIO disclosure adds that the three flaws can also expose some encrypted sessions to eavesdroppers.

Want the next updates in your inbox? Get the daily edition →

See all 6 updates

10/27/2026 01:37 PM
New detail on the cause: the server loaded the revocation list into its OpenSSL backend but never turned revocation checking on, so revoked client certificates still passed login on mutual-TLS setups.
10/27/2026 11:23 AM
Disclosure expands the alert to three TLS flaws that can also expose encrypted sessions to decryption, depending on specific OpenSSL, LibreSSL or Mbed TLS configurations.
10/27/2026 09:03 AM
FoxIO discloses a critical flaw that makes GoAhead accept revoked certificates and cites a second bug, a 2018 typo.