GoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws
Embedthis GoAhead embedded web server
Embedthis GoAhead, the embedded web server behind device-management pages on many IoT, firewall and OT products, fixed eleven advisories in 6.1.1. The critical ones: a Basic and form-auth bypass for users with BF1 (Blowfish) stored hashes where any password works (6.1.0, CVE-2026-115888), OpenSSL builds that load a CRL but never enforce it so revoked mTLS client certificates are still accepted (3.4.5 to 6.1.0, CVE-2026-115881), and Windows CGI command injection through .bat/.cmd scripts run via cmd.exe. Others include mTLS chain-depth bypass on LibreSSL legacy-verifier builds (CVE-2026-115884), httpoxy-style CGI HTTP_PROXY injection (CVE-2026-115882), CGI ISINDEX option injection (CVE-2026-115880), a 1-byte DH modulus on Mbed TLS builds that makes TLS 1.2 DHE_RSA sessions decryptable, request smuggling, and session fixation. The advisories went out Oct 12; FoxIO's Oct 26 write-up on the three TLS bugs drew wide attention. Upgrade to 6.1.1; devices only get the fix when their manufacturer ships new firmware.
Why this severity: Vendor-rated critical (CVSS 9.8 / 9.1 / 9.8), but each bug depends on the build: TLS library, mTLS and CRL use, BF1 password hashes, or Windows CGI scripts
- Started
- Oct 12, 2026
Affected
- GoAhead <= 6.1.0 (ranges differ per advisory, e.g. CRL bypass >= 3.4.5, BF1 auth bypass 6.1.0 only, Mbed TLS DH bug >= 4.0.2)
Fixed in
- GoAhead 6.1.1
Timeline2
FoxIO publishes 'Three TLS Bugs in GoAhead' (CRL bypass, LibreSSL chain-depth bypass, Mbed TLS 1-byte DH modulus) and warns that hundreds of millions of devices embed GoAhead and rarely get updated.
Embedthis publishes eleven GoAhead security advisories and the v6.1.1 release (shipped to device builders Aug 2), including critical BF1 auth bypass, OpenSSL CRL non-enforcement and Windows CGI command injection.
Advisories5
- GoAhead v6.1.1 release notesembedthis/goahead · Oct 12, 2026
- GHSA-qj3g-66fp-rhhr: Authentication bypass for BF1-hashed users (CVE-2026-115888)embedthis/goahead · Oct 12, 2026
- GHSA-5m75-xq69-c3c5: OpenSSL CRL loaded but not enforced (CVE-2026-115881)embedthis/goahead · Oct 12, 2026
- GHSA-584w-ph2x-4gfq: Windows CGI command injection via .bat / .cmd targetsembedthis/goahead · Oct 12, 2026
- GoAhead security advisoriesembedthis/goahead
News & write-ups2
Posts1
These vulns were patched in the latest GoAhead 6.1.1, however, IoT and OT devices are rarely updated, leaving hundreds of millions of devices vulnerable. Manufacturers will need to push this update and notify clients.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
