Loading vulnerability…
Certificate Revocation Check Bypass in GoAhead's OpenSSL Backend
CVE-2026-115881 is a certificate-revocation validation flaw in EmbedThis GoAhead versions 3.4.5 through 6.1.0 using OpenSSL or a compatible TLS library with mutual TLS and a configured certificate revocation list (CRL). GoAhead loads the CRL into the certificate store but fails to enable X509_V_FLAG_CRL_CHECK, leaving revocation checks unenforced. Consequently, a revoked client certificate can complete mutual TLS authentication even when issuer verification is enabled. The flaw was reproduced with GoAhead 6.1.0 and OpenSSL 3.6.2. EmbedThis assigns it a CVSS score of 9.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Revocation does not prevent a previously trusted client identity from authenticating to an affected service. An attacker retaining a revoked certificate and its private key may regain access to management interfaces, APIs, sensitive information, or other protected resources within that identity's existing permissions. Administrative identities may permit configuration changes or other privileged operations. This is not a general authentication bypass against default GoAhead installations and does not inherently grant permissions beyond those associated with the accepted identity.
If you can’t patch tonight, do this now.
No interim configuration workaround is identified in the vendor advisory. Until corrected firmware is available, reduce exposure by restricting affected management interfaces to trusted administrative networks through segmentation, VPNs, firewall rules, or access control lists. Correlate successful certificate authentications with revocation records and investigate access by revoked identities, especially certificates revoked because of suspected private-key compromise. These measures reduce exposure or aid detection but do not restore CRL enforcement.
Patch, then assume compromise.
Upgrade to GoAhead 6.1.1 or later, which enables CRL checking after loading the configured revocation list. For embedded products, install manufacturer-provided firmware incorporating the fix; upgrading the upstream software alone does not update deployed appliances. Validate the correction with a dedicated test certificate by revoking it and confirming that subsequent mutual TLS authentication fails.
No public exploits tracked yet. Mallory keeps watching.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.