Multiple security vulnerabilities have been identified in GoAhead, a lightweight web server used in management interfaces for networking, printing, and industrial systems. The issues affect TLS handling in builds from 3.4.5 through 6.1.0, from 4.0.2 through 6.1.0, and up to 6.1.0 in certain library configurations, creating risks related to certificate validation and session security. The overall risk is high because affected deployments may continue to accept invalid client credentials or expose sessions under certain configurations.
CVE-2026-115881 (CVSS 9.1 — Critical): In GoAhead 3.4.5 through 6.1.0 built with OpenSSL or a compatible library and configured for mutual TLS with a certificate revocation list, the server reads the list but does not use it for validation. An attacker holding a revoked client certificate can still complete authentication, even when issuer verification is enabled.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in GoAhead, a lightweight web server used in management interfaces for networking, printing, and industrial systems. The issues affect TLS handling in builds from 3.4.5 through 6.1.0, from 4.0.2 through 6.1.0, and up to 6.1.0 in certain library configurations, creating risks related to certificate validation and session security. The overall risk is high because affected deployments may continue to accept invalid client credentials or expose sessions under certain configurations.
CVE-2026-115881 (CVSS 9.1 — Critical): In GoAhead 3.4.5 through 6.1.0 built with OpenSSL or a compatible library and configured for mutual TLS with a certificate revocation list, the server reads the list but does not use it for validation. An attacker holding a revoked client certificate can still complete authentication, even when issuer verification is enabled.[emaillocker id="1283"]
CVE-2026-115884 (CVSS 7.4 — High): In GoAhead up to 6.1.0 built with LibreSSL 3.2.x or 3.3.2 through 3.3.6, a certificate-chain length limit can be bypassed when client certificates are required but accepted from any issuer. An attacker can present a chain that evades the cap, allowing unauthorized client-certificate authentication in affected configurations.
These vulnerabilities collectively present a significant risk to devices that expose GoAhead management interfaces, especially those using affected TLS libraries and certificate configurations. The most at-risk deployments are internet-facing systems that rely on client-certificate authentication without effective revocation or issuer controls. The general action is to identify affected configurations and assess exposure of management interfaces.
We recommend you to update GoAhead to version 6.1.1.
The following reports contain further technical details:
[/emaillocker]