CVE-2026-115881

A critical vulnerability in the GoAhead embedded web server (CVE-2026-115881, CVSS 9.1) bypasses certificate revocation checks during mutual TLS (mTLS) authentication. This means a client certificate that has been explicitly revoked by the CA will still be accepted as valid, allowing previously trusted but now compromised identities to maintain access to devices and services.

Affected Versions: GoAhead 3.4.5 through 6.1.0 when mTLS is enabled. Root Cause: The server fails to validate the certificate revocation status (likely missing CRL or OCSP checks) during the TLS handshake. Impact: An attacker in possession of a revoked client certificate can authenticate to the web server. This is particularly dangerous for IoT, embedded systems, and network appliances where GoAhead is commonly deployed. MITRE ATT&CK: This facilitates Valid Accounts (T1078) and Exploit Public-Facing Application (T1190) .

Defense: Immediately update GoAhead to a patched version. As a compensating control, implement application-level certificate validation or a reverse proxy that enforces revocation checks before traffic reaches the GoAhead instance. Monitor for authentication from certificates that should have been revoked.

Source: https://socprime.com/blog/cve-2026-115881-analysis/