GoAhead Web Server

Your router, printer, or industrial controller might be accepting logins from stolen or retired devices, because a critical flaw in the GoAhead embedded web server means a revoked client certificate can still pass authentication, and the fix requires a firmware update from the manufacturer that many owners may never receive.

The flaw is tracked as CVE-2026-115881, it carries a 9.1 severity rating from EmbedThis, and it affects builds using the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa.

The Silent Revocation Failure

Here is the frustrating part: an operator who sets up a revocation list to block stolen certificates has every reason to think it is working. The server loads the revocation list file at startup and reports no error.

But the server never turns revocation checking on. It is just sitting there, silently ignoring the list.

In FoxIO's test against GoAhead 6.1.0 with OpenSSL 3.6.2, a revoked certificate was accepted with issuer checking switched on. A client whose certificate was revoked, like a stolen or retired device, completes the handshake as if the certificate were still valid, and gets whatever access that identity allows.

The Other TLS Flaws and the Login Bypass

The revoked certificate issue is not the only problem in this release. Researchers found two other TLS issues tied to specific backends, and EmbedThis shipped a critical login bypass fix in the same 6.1.1 patch.

The Mbed TLS problem only reaches a session if the client accepts the broken setup, because OpenSSL, current Go, current Java, and mainstream browsers refuse a value that small. The login bypass, however, is a different story, because EmbedThis says form login is the default for its built-in administration pages.

Why This Is So Hard to Fix

Which backend and settings a build uses are chosen when the firmware is compiled, so a device owner cannot tell from the outside which apply.

That is also why the fix is slow to arrive, because GoAhead 6.1.1 is a drop-in replacement that device makers rebuild and ship as a firmware update, and an owner gets it only when their manufacturer does so. Whether any manufacturer has shipped it is not known.

The flaw was found by Sébastien Féry of FoxIO, who described it and the two other TLS problems in a write-up on October 26. GoAhead is used in routers, printers, gateways, and industrial controllers, and its maker, EmbedThis, says it runs in hundreds of millions of devices.

What Device Owners Should Do

As of October 27, no source reported any of these problems being used in attacks, but the lack of known attacks does not mean you are safe. EmbedThis's policy is to end a disclosure embargo early if a flaw is being exploited, so the coordinated October 12 release is consistent with no known attacks, but it does not prove there are none.

• Check for firmware updates: The only real fix is GoAhead 6.1.1. Contact your device manufacturer and ask if they have shipped a firmware update that includes it.
• Hunt for exposed devices: FoxIO has published proof-of-concept code and offers fingerprints through its JA4Scan tool to find GoAhead servers by backend, though a fingerprint identifies a build, not a confirmed-vulnerable server.
• Mitigate where possible: If you manage the firmware yourself, upgrade to 6.1.1, end active sessions, restart the server, and change any Blowfish-stored passwords.

FAQ

What is CVE-2026-115881?

It is a 9.1 severity flaw in the GoAhead web server that prevents the OpenSSL backend from actually checking a certificate revocation list. A stolen or retired device with a revoked certificate can still log in.

Is my router affected?

It depends on how the firmware was compiled. You cannot tell from the outside, because the backend and settings are chosen at compile time. You need to contact your manufacturer and ask if they have shipped a firmware update for GoAhead 6.1.1.

Why didn't the revocation list work?

The server loaded the file into memory and reported no error at startup, so operators thought it was working. But the code never turned revocation checking on, so the list was completely ignored.

What is the Blowfish login bypass?

It is a separate flaw in GoAhead 6.1.0 where an attacker who knows a valid username can log in with any password, as long as the stored password is in the newer Blowfish format. It is patched in 6.1.1.

Has this been exploited in the wild?

As of October 27, no source has reported any of these problems being used in attacks. However, the flaw is public and proof-of-concept code is available, so patching as soon as your manufacturer releases it is critical.

Source: The Hacker News