EN PT-BR
← Voltar ao feed
high iot industrial telecommunications defense

GoAhead 6.1.1 fixes TLS flaws: revoked client certificates accepted (CVE-2026-115881), LibreSSL chain bypass (CVE-2026-115884) and session decryption

3 fonte(s) · 3 atualização(ões) · publicado 27/10/2026 10:59 · coletado há 4 dias

EmbedThis released GoAhead 6.1.1 to fix several TLS weaknesses in the embedded web server, which the vendor says runs in hundreds of millions of devices. The most severe, CVE-2026-115881 (CVSS 9.1), affects builds using the OpenSSL backend (or a compatible library, per securityweek.com) with mutual TLS. The server loads the certificate revocation list but never enables revocation checking, so revoked client certificates still authenticate. Sébastien Féry of FoxIO found the flaw and described it and two other TLS problems around October 26. gbhackers.com and securityweek.com put the affected range at GoAhead 3.4.5 through 6.1.0 and stress that exposure depends on the TLS library, build options and client behavior, not simply on using GoAhead. securityweek.com adds that the LibreSSL chain-length flaw has its own identifier, CVE-2026-115884 (CVSS 7.4), while the Mbed TLS flaw (CVSS 5.9) has no CVE. It reports that 6.1.1 was released on August 2 and that advisories for all three flaws were published on October 12. FoxIO founder John Althouse named Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin and Boeing among companies whose devices rely on GoAhead, but FoxIO has not said whether any of their products use a vulnerable configuration (securityweek.com). No source reported exploitation as of October 28, and the population of affected devices is not established.

Entenda a falha

A vulnerabilidade

CVE-2026-115881 (CVSS 9.1, vendor rating) is in the GoAhead embedded web server from EmbedThis. It affects builds using the OpenSSL backend (securityweek.com says OpenSSL or a compatible library) with mutual TLS and a CRL, in 3.4.5 through 6.1.0. The server loads the CRL but never enforces it, so an attacker with a revoked certificate from a trusted CA and its private key still authenticates. Default builds do not enable mTLS or a CRL, and Mbed TLS builds are unaffected. CVE-2026-115884 (CVSS 7.4, GOAHEAD-SA-2026-0004) affects builds up to 6.1.0 with LibreSSL 3.2.x or 3.3.2 to 3.3.6 that require client certificates with issuer checking off: a chain longer than 10 certificates is accepted. GOAHEAD-SA-2026-0005 (CVSS 5.9, no CVE) affects Mbed TLS builds of 4.0.2 through 6.1.0: TLS 1.2 DHE_RSA sessions can be decrypted offline if the client accepts the weak parameters. 6.1.1 fixes them, plus a Blowfish login bypass in 6.1.0.

Como funciona

At startup the server reads the CRL file and reports no error. When a client presents its certificate in the mutual TLS handshake, the OpenSSL backend validates it against the trusted CA bundle. Revocation checking was never switched on, so the loaded list is not consulted. A stolen or retired device with a revoked certificate completes the handshake and gets that identity's access, and the operator sees no warning. In the LibreSSL case, an over-long chain produces an issuer error that GoAhead tolerates, so the chain-depth limit is bypassed and the handshake completes. In the Mbed TLS case, the server sends a Diffie-Hellman modulus reduced to one byte. Clients without a minimum-size check accept it, and anyone who recorded the TLS 1.2 DHE_RSA traffic can recover the key.

Por que é vulnerável

For CVE-2026-115881 the cause is a missing step: the OpenSSL backend loads the CRL but never sets the X509_V_FLAG_CRL_CHECK flag (per gbhackers.com), so verification succeeds without consulting the list. Because loading succeeds silently, operators get false assurance. Mbed TLS checks revocation through a separate code path. The related bugs have their own causes: a tolerated issuer error that bypasses the chain-depth limit on older LibreSSL, and a buffer-length typo that shrinks a 2048-bit DH modulus to one byte on Mbed TLS. The articles do not say why they went unnoticed. The fix is GoAhead 6.1.1, a drop-in replacement.

Onde está

The articles point to the OpenSSL backend's certificate verification, where X509_V_FLAG_CRL_CHECK is never set, as described in the Embedthis advisory (the related ones are GOAHEAD-SA-2026-0004 and -0005); no file or function is named.

Como foi descoberta

Sébastien Féry of FoxIO found the flaws and described them and the other TLS problems in a write-up around October 26 (securityweek.com says he documented them this week). According to securityweek.com, GoAhead 6.1.1 was released on August 2 and advisories for all three flaws were published on October 12; The Hacker News says 6.1.1 went to device makers on August 2 and was published on October 12, and gbhackers.com words the August 2 date as availability for device builders. FoxIO confirmed the revocation flaw against GoAhead 6.1.0 with OpenSSL 3.6.2. EmbedThis has requested CVE IDs, which were not live in CVE/NVD on October 27. No source reported exploitation as of October 28.

PoC pública

FoxIO has published proof-of-concept code, according to The Hacker News and securityweek.com, but the articles do not describe its contents or maturity. FoxIO also offers JA4Scan fingerprints that identify a GoAhead server's TLS backend, not whether it is vulnerable; the tool is free and its source is available on request. Exploitation needs a revoked certificate and its private key, and the affected setup is not the default. Even so, with public PoC code defenders should not count on obscurity and should prioritize firmware updates for devices using mutual TLS with a CRL.

Publicada em: thehackernews.com/2026/10/goahead-tls-flaws-allow-revoked-client.html ↗

Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 12:18.

Detalhes técnicos

  • Revocation bypass (CVE-2026-115881): The affected build must use the OpenSSL backend with client certificates required, a trusted CA bundle, issuer checking enabled and a CRL configured. The attacker must hold a certificate signed by a trusted CA that is listed as revoked, plus its private key. The server loads the CRL without error, giving operators false assurance; securityweek.com notes nothing at startup warns that revocation checks are inactive, and that the revoked certificate (for example one tied to a stolen or compromised device) is accepted even with issuer verification on. gbhackers.com identifies the root cause as the missing X509_V_FLAG_CRL_CHECK flag in OpenSSL verification, and notes this is a revocation bypass, not authentication without a certificate. Default builds do not enable mTLS or load a CRL (gbhackers.com). FoxIO confirmed it against GoAhead 6.1.0 with OpenSSL 3.6.2. Mbed TLS builds are unaffected.
  • Mbed TLS key exchange issue (GOAHEAD-SA-2026-0005, CVSS 5.9, no CVE per securityweek.com): Affects Mbed TLS builds of GoAhead 4.0.2 through 6.1.0. A buffer-length typo reduces a 2048-bit Diffie-Hellman modulus to one byte (gbhackers.com). Sessions can be decrypted offline by anyone who recorded the traffic (TLS 1.2 DHE_RSA), but only if the client accepts the very small key-exchange value. OpenSSL, current Go, current Java and mainstream browsers refuse it. Some embedded or custom clients without a minimum-size check accept it. TLS 1.3 and ECDHE sessions are unaffected, and Mbed TLS 4.x removed the key exchange involved.
  • LibreSSL chain-length issue (GOAHEAD-SA-2026-0004, CVE-2026-115884, CVSS 7.4): On GoAhead up to 6.1.0 built with LibreSSL 3.2.x or 3.3.2 through 3.3.6 (gbhackers.com, securityweek.com), with client certificates required and issuer checking off, a chain longer than GoAhead's 10-certificate limit completes the handshake as an authenticated client without any trusted key. securityweek.com stresses that the length cap is the only safeguard bypassed, since the server accepts certificates from any issuer. The overlong chain produces an issuer error that GoAhead tolerates (gbhackers.com). OpenSSL, BoringSSL, AWS-LC and LibreSSL 4.x reject the over-long chain.
  • Handshake behavior: Féry noted that none of the defects prevents the affected handshake from completing (securityweek.com).
  • Login bypass: The same release closes 11 advisories, three of them critical. One lets an attacker who knows a valid username log in with any password when that user's password is stored in the Blowfish format added in 6.1.0. This affects HTTP Basic or form login, and form login is the default for the built-in admin pages.
  • The identifiers were not yet live in CVE/NVD as of October 27, and the severity ratings are the vendor's own. FoxIO has published proof-of-concept code and JA4Scan fingerprints that identify the backend of a GoAhead server, but not whether it is vulnerable. securityweek.com says the fingerprints help defenders find internet-facing GoAhead servers and determine which TLS library they rely on.

Remediação

  • GoAhead 6.1.1 is a drop-in replacement that device makers must rebuild into firmware (gbhackers.com: 6.1.1 or later). Owners get it only when their manufacturer ships an update, and it is unknown whether any have. Althouse cautioned that an upstream fix "doesn't mean there's a patch available for the devices yet" (securityweek.com).
  • After upgrading, EmbedThis recommends ending active sessions, restarting the server and changing Blowfish-stored passwords.
  • Operators should confirm their firmware includes the fixes and review the actual TLS configuration (gbhackers.com).
  • Interim measures (gbhackers.com, securityweek.com): disable finite-field DHE suites on Mbed TLS builds or move to the OpenSSL backend, and enable issuer verification with a trusted CA bundle on affected LibreSSL builds, or switch to OpenSSL or LibreSSL 4.x. These address different bugs and do not replace the CRL enforcement patch.
  • EmbedThis notifies customers of security updates through its Builder portal.

Relatos divergentes

  • Disclosure and release dates: The earlier report says FoxIO described the flaws on October 26. securityweek.com says Féry documented them "this week", that GoAhead 6.1.1 was released on August 2 and that advisories for all three flaws were published on October 12, which matches the dates gbhackers.com mentioned. The advisory-based dates are likely more authoritative for when the fixes and advisories were published, while October 26 probably reflects FoxIO's public write-up.
  • Scope of the revocation flaw: Earlier reports describe it as limited to the OpenSSL backend. securityweek.com says OpenSSL or a compatible library; the more specific vendor and FoxIO documentation should be consulted for exact build coverage.

Linha do tempo

  1. securityweek.com ↗ · pub. 28/10/2026 10:10 · coletado 28/10 12:00

    FoxIO discloses three GoAhead web server TLS flaws, including CVE-2026-115881 and CVE-2026-115884

    SecurityWeek assigns CVE-2026-115884 to the LibreSSL chain-length bypass (CVSS 7.4) and says the Mbed TLS bug (CVSS 5.9) has no CVE. It dates GoAhead 6.1.1 to Aug 2 and the advisories to Oct 12. It also reports that FoxIO's John Althouse named many vendors whose devices rely on GoAhead, without confirming that any use a vulnerable configuration.

    ler a análise desta fonte

    SecurityWeek assigns CVE-2026-115884 to the LibreSSL chain-length bypass (CVSS 7.4) and says the Mbed TLS bug (CVSS 5.9) has no CVE. It dates GoAhead 6.1.1 to Aug 2 and the advisories to Oct 12. It also reports that FoxIO's John Althouse named many vendors whose devices rely on GoAhead, without confirming that any use a vulnerable configuration.

    FoxIO disclosed three TLS vulnerabilities in GoAhead, the lightweight embedded web server from EmbedThis. FoxIO says it runs on hundreds of millions of IoT, OT, firewall and military devices. The flaws can keep revoked client certificates working, allow offline decryption of some TLS 1.2 sessions, or bypass a certificate chain length cap. Sébastien Féry documented them, and each affects only a subset of deployments, depending on the TLS library built into the firmware and how certificate checks were configured. GoAhead 6.1.1 (released Aug 2) fixes the OpenSSL and Mbed TLS issues, but device makers must ship it in firmware. No exploitation is reported.

    Technical Details

    • CVE-2026-115881 (CVSS 9.1): Affects GoAhead 3.4.5 through 6.1.0 built with OpenSSL or a compatible library and configured for mutual TLS with a CRL. The server reads the CRL but never tells OpenSSL to consult it, so revoked certificates (for example from stolen or compromised devices) are still accepted, even with issuer verification on. Nothing at startup warns that revocation checks are inactive.
    • Unassigned CVE (CVSS 5.9): Affects GoAhead 4.0.2 through 6.1.0 builds using Mbed TLS. A coding error weakens the encryption of some TLS 1.2 connections so that recorded sessions can be decrypted offline, but only if the client accepts the flawed parameters.
    • CVE-2026-115884 (CVSS 7.4): Affects GoAhead up to 6.1.0 built with LibreSSL 3.2.x or 3.3.2 through 3.3.6. It works only against servers that require client certificates but accept any issuer, so the length cap is the only safeguard bypassed.
    • Féry noted that none of the defects prevents the affected handshake from completing.
    • FoxIO released proof-of-concept code and fingerprints for finding internet-facing GoAhead servers and identifying their TLS library.
    • FoxIO founder John Althouse named Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin and Boeing among companies whose devices rely on GoAhead. FoxIO has not said whether any of their products use a vulnerable configuration.

    Remediation

    • Upgrade to GoAhead 6.1.1, which resolves the OpenSSL and Mbed TLS issues. Advisories for all three flaws were published on Oct 12.
    • Mbed TLS builds can be protected by disabling finite-field DHE cipher suites or moving to the OpenSSL backend.
    • For the LibreSSL issue, enable issuer verification with a trusted CA bundle, or switch to OpenSSL or LibreSSL 4.x.
    • An upstream fix does not mean a device patch exists; availability depends on each manufacturer (Althouse).
  2. gbhackers.com ↗ · pub. 28/10/2026 03:51 · coletado 28/10 04:00

    GoAhead CVE-2026-115881 lets revoked client certificates pass mutual TLS checks; two more TLS flaws disclosed

    The article adds the exact root cause of CVE-2026-115881 (missing X509_V_FLAG_CRL_CHECK), the affected range (GoAhead 3.4.5 through 6.1.0), CVSS scores and advisory IDs for the other two flaws (GOAHEAD-SA-2026-0004 at 7.4 and GOAHEAD-SA-2026-0005 at 5.9), the affected LibreSSL and Mbed TLS version ranges, the buffer-length typo behind the DH weakness, and interim mitigations. It also states the advisories were published October 12, which conflicts with the October 26 disclosure date in the known report.

    ler a análise desta fonte

    The article adds the exact root cause of CVE-2026-115881 (missing X509_V_FLAG_CRL_CHECK), the affected range (GoAhead 3.4.5 through 6.1.0), CVSS scores and advisory IDs for the other two flaws (GOAHEAD-SA-2026-0004 at 7.4 and GOAHEAD-SA-2026-0005 at 5.9), the affected LibreSSL and Mbed TLS version ranges, the buffer-length typo behind the DH weakness, and interim mitigations. It also states the advisories were published October 12, which conflicts with the October 26 disclosure date in the known report.

    A critical flaw in the GoAhead embedded web server, tracked as CVE-2026-115881 (CVSS 9.1), lets revoked client certificates pass mutual TLS authentication, so identities that administrators blocked can regain access. It affects GoAhead 3.4.5 through 6.1.0 with specific mTLS settings and is fixed in GoAhead 6.1.1. FoxIO detailed it with two other TLS integration bugs, one weakening certificate chain checks and one allowing passive decryption of captured sessions. FoxIO says GoAhead runs on hundreds of millions of devices (routers, printers, gateways, industrial equipment), but exposure depends on the TLS library, build options and client behavior. The article reports no exploitation.

    Technical Details

    • CVE-2026-115881 (CVSS 9.1): The OpenSSL backend loads the configured CRL but never sets X509_V_FLAG_CRL_CHECK, so verification succeeds without consulting the list. Loading succeeds silently, with no startup warning. The attacker needs a previously trusted, revoked certificate and its private key. This is a revocation bypass, not authentication without a certificate. Default builds do not enable mTLS or load a CRL.
    • GOAHEAD-SA-2026-0004 (CVSS 7.4): Affects builds using LibreSSL's legacy verifier (3.2.x or 3.3.2 through 3.3.6) when client certificates are required but issuer checking is disabled. An overlong certificate chain produces an issuer error that GoAhead tolerates, bypassing the chain-depth limit. Ordinary self-signed certificates are already accepted under that configuration.
    • GOAHEAD-SA-2026-0005 (CVSS 5.9): Affects Mbed TLS builds of GoAhead 4.0.2 through 6.1.0. A buffer-length typo reduces a 2048-bit Diffie-Hellman modulus to one byte. A passive observer can decrypt completed TLS 1.2 DHE_RSA sessions if the client accepts the weak parameters. TLS 1.3 and ECDHE sessions are unaffected.
    • The advisories were published October 12, according to the article.

    Remediation

    • Device makers should rebuild and ship firmware with GoAhead 6.1.1 or later.
    • Operators should confirm their firmware includes the fixes and review their actual TLS configuration.
    • Temporary measures: disable finite-field DHE suites on Mbed TLS builds, and enable issuer verification with a trusted CA bundle on affected LibreSSL builds. These address different bugs and do not replace the CRL enforcement patch.
  3. thehackernews.com ↗ · pub. 27/10/2026 10:59 · coletado 27/10 15:00 primeiro registro

    GoAhead 6.1.1 fixes TLS flaws: revoked client certificates accepted (CVE-2026-115881) and session decryption

    ler a análise desta fonte

    EmbedThis released GoAhead 6.1.1 to fix several TLS weaknesses in the embedded web server, which the vendor says runs in hundreds of millions of devices. The most severe, CVE-2026-115881 (rated 9.1 by EmbedThis), affects builds using the OpenSSL backend with mutual TLS. The server loads the certificate revocation list but never enables revocation checking, so revoked client certificates still authenticate. Sébastien Féry of FoxIO found the flaw and described it and two other TLS problems on October 26. No source reported exploitation as of October 27, and the population of affected devices is not established.

    Technical Details

    • Revocation bypass (CVE-2026-115881): The affected build must use the OpenSSL backend with client certificates required, a trusted CA bundle, issuer checking enabled and a CRL configured. The attacker must hold a certificate signed by a trusted CA that is listed as revoked. The server loads the CRL without error, giving operators false assurance. FoxIO confirmed it against GoAhead 6.1.0 with OpenSSL 3.6.2. Mbed TLS builds are unaffected.
    • Mbed TLS key exchange issue: Sessions can be decrypted by anyone who recorded the traffic, but only if the client accepts a very small key-exchange value. OpenSSL, current Go, current Java and mainstream browsers refuse it. Some embedded or custom clients without a minimum-size check accept it. TLS 1.3 and ECDHE sessions are unaffected, and Mbed TLS 4.x removed the key exchange involved.
    • LibreSSL chain-length issue: On older LibreSSL builds with client certificates required and issuer checking off, a chain longer than GoAhead's 10-certificate limit completes the handshake as an authenticated client without any trusted key. OpenSSL, BoringSSL, AWS-LC and LibreSSL 4.x reject the over-long chain.
    • Login bypass: The same release closes 11 advisories, three of them critical. One lets an attacker who knows a valid username log in with any password when that user's password is stored in the Blowfish format added in 6.1.0. This affects HTTP Basic or form login, and form login is the default for the built-in admin pages.
    • The identifiers were not yet live in CVE/NVD as of October 27, and the severity ratings are the vendor's own. FoxIO has published proof-of-concept code and JA4Scan fingerprints that identify the backend of a GoAhead server, but not whether it is vulnerable.

    Remediation

    • GoAhead 6.1.1 is a drop-in replacement that device makers must rebuild into firmware. Owners get it only when their manufacturer ships an update, and it is unknown whether any have.
    • After upgrading, EmbedThis recommends ending active sessions, restarting the server and changing Blowfish-stored passwords.
    • EmbedThis notifies customers of security updates through its Builder portal.