GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption
The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups.
The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups.
The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked certificates.
That is a setup an operator turns on deliberately; a default build does not.
GoAhead 6.1.1 , released to device makers on August 2, 2026, and publicly published on October 12, fixes it; the flaw was found by Sébastien Féry of FoxIO, who described it and two other TLS problems in a write-up on October 26.
GoAhead is a small web server that device makers build into firmware to run management pages on routers, printers, gateways and industrial controllers.
Its maker, EmbedThis, says it runs in hundreds of millions of devices.
On an affected build, the server loads the revocation list file at startup and reports no error, so an operator who configured it has every reason to think revocation is working.
A client whose certificate was revoked, for example a stolen or retired device, completes the handshake as if the certificate were still valid and gets whatever access that identity allows.
To be exploited, the build must use the OpenSSL backend with client certificates required, a trusted certificate authority bundle and issuer checking enabled, and a revocation list configured; the attacker must hold a certificate signed by a trusted authority and listed as revoked.
The identifier on the advisory is CVE-2026-115881, rated 9.1 by EmbedThis.
As of October 27, that identifier and the others below were not yet live in the public CVE and NVD databases; EmbedThis says it has requested them.
In FoxIO's test against GoAhead 6.1.0 with OpenSSL 3.6.2, a revoked certificate was accepted with issuer checking switched on, and builds that use the Mbed TLS backend are unaffected; that backend checks revocation via a separate code path.
Clients without a minimum-size check, such as some embedded or custom ones, accept it, and then anyone who recorded the traffic can work out the key and read the session.
It appears only on builds linked against the older LibreSSL versions listed above and only where client certificates are required with issuer checking off.
What happened
The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups.
The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked certificates.
That is a setup an operator turns on deliberately; a default build does not.
What changed
GoAhead 6.1.1 , released to device makers on August 2, 2026, and publicly published on October 12, fixes it; the flaw was found by Sébastien Féry of FoxIO, who described it and two other TLS problems in a write-up on October 26.
Who is affected
GoAhead is a small web server that device makers build into firmware to run management pages on routers, printers, gateways and industrial controllers.
Its maker, EmbedThis, says it runs in hundreds of millions of devices.
Why it matters
On an affected build, the server loads the revocation list file at startup and reports no error, so an operator who configured it has every reason to think revocation is working.
A client whose certificate was revoked, for example a stolen or retired device, completes the handshake as if the certificate were still valid and gets whatever access that identity allows.
Technical details
To be exploited, the build must use the OpenSSL backend with client certificates required, a trusted certificate authority bundle and issuer checking enabled, and a revocation list configured; the attacker must hold a certificate signed by a trusted authority and listed as revoked.
The identifier on the advisory is CVE-2026-115881, rated 9.1 by EmbedThis.
As of October 27, that identifier and the others below were not yet live in the public CVE and NVD databases; EmbedThis says it has requested them.
Response
In FoxIO's test against GoAhead 6.1.0 with OpenSSL 3.6.2, a revoked certificate was accepted with issuer checking switched on, and builds that use the Mbed TLS backend are unaffected; that backend checks revocation via a separate code path.
What security teams should do
Clients without a minimum-size check, such as some embedded or custom ones, accept it, and then anyone who recorded the traffic can work out the key and read the session.
It appears only on builds linked against the older LibreSSL versions listed above and only where client certificates are required with issuer checking off.
What remains unknown
Whether any manufacturer has shipped it is not known.
Attribution
The Hacker News: The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.