GoAhead, the tiny embedded web server inside router, printer, gateway and industrial controller management pages, had a nasty TLS bug. On builds using the OpenSSL backend with mutual TLS and a certificate revocation list configured, GoAhead loaded the CRL with no error but never actually turned revocation checking on. A revoked client cert, like one from a stolen or retired device, still got in.
The details
- Tracked as CVE-2026-115881, rated 9.1 by EmbedThis (not yet live in NVD as of today).
- Fixed in GoAhead 6.1.1, which went to device makers August 2 and public October 12.
- Found by Sébastien Féry of FoxIO, who also described problems in the Mbed TLS and LibreSSL builds.
- Mbed TLS builds aren’t hit by the revocation bug; EmbedThis says it runs in hundreds of millions of devices.
My take
This is the worst kind of bug: config says you’re protected, logs say nothing’s wrong, and you’re not. Don’t trust “it loaded fine.” Test it. Take a cert you’ve revoked and try to connect. And since this lives in firmware, the fix only reaches you when your device vendor ships it, so go bug them.
God Bless, and Needs Garlic!
