A flaw in the GoAhead embedded web server, CVE-2026-115881 with a CVSS score of 9.1, affects versions 3.4.5 to 6.1.0 on OpenSSL-backend mutual-TLS setups, and is fixed in GoAhead 6.1.1. The server loaded a configured certificate revocation list but never enabled revocation checking, so a revoked client certificate could still authenticate.

Revocation loaded, never checked

Researcher Sébastien Féry of FoxIO disclosed the findings on 26 October 2026. The flaws were reported privately in April 2026 and patched in GoAhead 6.1.1 in August, with public publication on 12 October.

Fix upstream is not fix in devices

GoAhead is built into firmware for routers, printers, gateways and industrial controllers. EmbedThis says it runs in hundreds of millions of devices, but a fix upstream does not mean device firmware has been updated: manufacturers must rebuild and ship it. Until that happens, a certificate revoked after a device is lost, stolen or decommissioned could still be accepted by an unpatched unit.

Two further TLS issues were disclosed alongside: a Mbed TLS key-exchange flaw that could weaken TLS 1.2 session confidentiality, and a LibreSSL chain-depth bypass (GOAHEAD-SA-2026-0004). No exploitation of these flaws had been reported as of 27 October 2026.

Sources: The Hacker News and Cybernews.