GoAhead TLS Flaw Lets Revoked Client Certificates Pass and Enables Session Decryption

GoAhead TLS Flaw Lets Revoked Client Certificates Pass and Enables Session Decryption

A bug in the GoAhead embedded web server allows a revoked client certificate to authenticate and decrypt TLS sessions when the OpenSSL backend is used with mutual-TLS. The flaw was discovered by Sébastien Féry of FoxIO and reported to EmbedThis on October 26, 2026. EmbedThis released GoAhead 6.1.1 on October 12, 2026, which disables the silent acceptance of revoked certificates.

Affected Product and Build Path

GoAhead is a lightweight web server that device makers embed in firmware for routers, printers, gateways, and industrial controllers. The vendor ships a default build that does not enable revocation checking, but operators can configure a revocation list file. When the OpenSSL backend is selected and mutual-TLS is enabled, the server loads the revocation list at startup and reports success, yet the revocation check is never executed. A client presenting a certificate that appears on the list completes the handshake as if the certificate were still valid.

The vulnerability exists only in builds that:

1. Use the OpenSSL backend.
2. Require client certificates (mutual-TLS).
3. Load a revocation list file.
4. Have issuer checking enabled.

Devices that use the Mbed TLS backend are unaffected because that backend performs revocation via a separate code path.

Attack Path and Exposure

An attacker who holds a certificate signed by a trusted authority and listed as revoked can:

1. Present the certificate during the TLS handshake.
2. Pass the server’s (non-existent) revocation check.
3. Gain whatever access the certificate’s identity grants.
4. Decrypt the session if the attacker can also obtain the session key or perform a man-in-the-middle attack.

FoxIO’s test against GoAhead 6.1.0 with OpenSSL 3.6.2 confirmed that a revoked certificate was accepted when issuer checking was enabled. The OpenSSL advisory describes the issue as “silently accepted.”

Evidence and Logs

• The server logs a successful load of the revocation list at startup.
• No error is emitted when the list contains revoked entries.
• Handshake logs show the client certificate as valid, with no revocation status reported.
• Network captures reveal that the session proceeds to application layer traffic after the handshake.

Defenders should inspect the following:

• TLS handshake logs for entries indicating client certificate acceptance.
• Server startup logs for revocation list load messages.
• Configuration files to confirm whether the OpenSSL backend and mutual-TLS are enabled.
• Firmware version and backend selection in the device’s build configuration.

Mitigation Steps

1. Update to GoAhead 6.1.1 or later. The patch disables the silent acceptance of revoked certificates.
2. Verify backend selection. If the device uses OpenSSL with mutual-TLS, apply the update immediately.
3. Audit configuration. Ensure that revocation checking is enabled if a revocation list is used.
4. Monitor logs. Look for successful client certificate handshakes that do not report revocation status.
5. Consider switching to Mbed TLS if the device’s firmware allows, as that backend enforces revocation.

CVE and Advisory

The flaw is identified as CVE-2026-115881 and rated 9.1 by EmbedThis. The advisory notes that the issue is not yet listed in public CVE or NVD databases as of October 27, 2026. EmbedThis has requested inclusion.

Further Reading

For a deeper technical dive into the TLS stack differences, see the Zero-Day Vulnerability & CVE Exploit Matrix.

Related coverage

• Wasmtime Sandbox Escape Vulnerabilities Exposed
• PHP2Shell CVEs: Immediate Patch Required for PHP 8.2.x and 8.3.x

Explore more on this topic

• More goahead coverage