GoAhead 6.1.1 Fixes TLS Flaws and Login Bypass in Embedded Web Server
Summary
GoAhead 6.1.1 fixes three backend-specific TLS flaws and a login bypass. No exploitation had been reported as of Oct. 27, 2026; the affected device population and manufacturer firmware rollouts remain unknown.
Key points
- On certain OpenSSL mutual-TLS builds, GoAhead loaded a configured certificate revocation list but did not enable revocation checking, allowing revoked client certificates to authenticate. EmbedThis rated the issue CVE-2026-115881 at 9.1.
- A Mbed TLS flaw can expose recorded session traffic when a client accepts an undersized key-exchange value; mainstream clients generally reject it, and TLS 1.3 and ECDHE sessions are unaffected.
- On certain older LibreSSL builds, a client certificate chain exceeding GoAhead's 10-certificate limit could still complete authentication without a trusted key.
- GoAhead 6.1.1 fixes the issues. Device makers must rebuild and ship firmware updates; whether manufacturers have shipped fixes was unknown as of Oct. 27, 2026.
- The release closes 11 advisories overall, including a login bypass affecting HTTP Basic or form login when a user's stored password uses the newer Blowfish format.
- EmbedThis recommends ending active sessions, restarting the server, and changing Blowfish-stored passwords after upgrading. No attacks exploiting the reported issues had been reported as of Oct. 27.
Article Details
- Vulnerability Types
- TLS client-certificate revocation checking is not enabled even when a revocation list is loaded.
- An undersized key-exchange value accepted by some clients can allow recorded TLS sessions to be decrypted.
- A client certificate chain longer than the 10-certificate limit can be accepted without a trusted key.
- Login bypass: on affected builds, knowing a valid username can allow login with any password when the stored password uses the newer Blowfish format.
- Severity
- 9.1 for CVE-2026-115881, rated by EmbedThis
- Affected Versions
- GoAhead 6.1.0
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- available
CVE
People
Vendors
Products
GoAheadThe GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups.LibreSSLThe LibreSSL problem allows an attacker to present a certificate chain longer than GoAhead's 10-certificate limit and still complete the handshake as an authenticated client, without any trusted key.Mbed TLSmust hold a certificate signed by a trusted authority and listed as revoked. Builds that use the Mbed TLS backend are unaffected; that backend checks revocation via a separate code path.OpenSSLThe flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked certificates.