# GoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws · pwn.watch

> Embedthis GoAhead, the embedded web server behind device-management pages on many IoT, firewall and OT products, fixed eleven advisories in 6.1.1. The critical ones: a Basic and form-auth bypass for users with BF1 (Blowfish) stored hashes where any password works (6.1.0, CVE-2026-115888), OpenSSL builds that load a CRL but never enforce it so revoked mTLS client certificates are still accepted (3.4.5 to 6.1.0, CVE-2026-115881), and Windows CGI command injection through .bat/.cmd scripts run via cmd.exe. Others include mTLS chain-depth bypass on LibreSSL legacy-verifier builds (CVE-2026-115884), httpoxy-style CGI HTTP_PROXY injection (CVE-2026-115882), CGI ISINDEX option injection (CVE-2026-115880), a 1-byte DH modulus on Mbed TLS builds that makes TLS 1.2 DHE_RSA sessions decryptable, request smuggling, and session fixation. The advisories went out Oct 12; FoxIO's Oct 26 write-up on the three TLS bugs drew wide attention. Upgrade to 6.1.1; devices only get the fix when their manufacturer ships new firmware.

Page: https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026 · generated 2026-10-27T07:39:32.612Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Embedthis GoAhead embedded web server
- Started: 2026-10-12
- CVEs: CVE-2026-115888, CVE-2026-115881, CVE-2026-115884, CVE-2026-115882, CVE-2026-115880
- Affected: GoAhead <= 6.1.0 (ranges differ per advisory, e.g. CRL bypass >= 3.4.5, BF1 auth bypass 6.1.0 only, Mbed TLS DH bug >= 4.0.2)
- Fixed in: GoAhead 6.1.1

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026/feed.xml
- JSON Feed: https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026.json
- This file: https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026/llms.txt

## Updates (newest first)
- 2026-10-26: FoxIO publishes 'Three TLS Bugs in GoAhead' (CRL bypass, LibreSSL chain-depth bypass, Mbed TLS 1-byte DH modulus) and warns that hundreds of millions of devices embed GoAhead and rarely get updated. (https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead)
- 2026-10-12: Embedthis publishes eleven GoAhead security advisories and the v6.1.1 release (shipped to device builders Aug 2), including critical BF1 auth bypass, OpenSSL CRL non-enforcement and Windows CGI command injection. (https://github.com/embedthis/goahead/releases/tag/v6.1.1)

## Fix brief
# Security brief: GoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws

Source: https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026 · status: live · severity: critical · updated Oct 27, 2026, 06:28 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Embedthis GoAhead, the embedded web server behind device-management pages on many IoT, firewall and OT products, fixed eleven advisories in 6.1.1. The critical ones: a Basic and form-auth bypass for users with BF1 (Blowfish) stored hashes where any password works (6.1.0, CVE-2026-115888), OpenSSL builds that load a CRL but never enforce it so revoked mTLS client certificates are still accepted (3.4.5 to 6.1.0, CVE-2026-115881), and Windows CGI command injection through .bat/.cmd scripts run via cmd.exe. Others include mTLS chain-depth bypass on LibreSSL legacy-verifier builds (CVE-2026-115884), httpoxy-style CGI HTTP_PROXY injection (CVE-2026-115882), CGI ISINDEX option injection (CVE-2026-115880), a 1-byte DH modulus on Mbed TLS builds that makes TLS 1.2 DHE_RSA sessions decryptable, request smuggling, and session fixation. The advisories went out Oct 12; FoxIO's Oct 26 write-up on the three TLS bugs drew wide attention. Upgrade to 6.1.1; devices only get the fix when their manufacturer ships new firmware.

Severity detail: Vendor-rated critical (CVSS 9.8 / 9.1 / 9.8), but each bug depends on the build: TLS library, mTLS and CRL use, BF1 password hashes, or Windows CGI scripts

- Product: Embedthis GoAhead embedded web server
- CVE / advisory ids: CVE-2026-115888, CVE-2026-115881, CVE-2026-115884, CVE-2026-115882, CVE-2026-115880

## Affected versions
- GoAhead <= 6.1.0 (ranges differ per advisory, e.g. CRL bypass >= 3.4.5, BF1 auth bypass 6.1.0 only, Mbed TLS DH bug >= 4.0.2)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- GoAhead 6.1.1

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
If you build firmware or software on Embedthis GoAhead, upgrade to 6.1.1. Until then: on Mbed TLS builds disable finite-field DHE suites; on LibreSSL legacy-verifier builds set VERIFY_ISSUER=1 with a trusted CA bundle; don't run .bat/.cmd CGI scripts on Windows; don't rely on CRLs for mTLS revocation. If you run devices with a GoAhead management page, check your vendor for firmware with GoAhead 6.1.1 and keep the management interface off the internet.

## Latest updates
- Oct 26, 2026: FoxIO publishes 'Three TLS Bugs in GoAhead' (CRL bypass, LibreSSL chain-depth bypass, Mbed TLS 1-byte DH modulus) and warns that hundreds of millions of devices embed GoAhead and rarely get updated.
- Oct 12, 2026: Embedthis publishes eleven GoAhead security advisories and the v6.1.1 release (shipped to device builders Aug 2), including critical BF1 auth bypass, OpenSSL CRL non-enforcement and Windows CGI command injection.

## Advisories
- [GoAhead v6.1.1 release notes](https://github.com/embedthis/goahead/releases/tag/v6.1.1) (embedthis/goahead)
- [GHSA-qj3g-66fp-rhhr: Authentication bypass for BF1-hashed users (CVE-2026-115888)](https://github.com/embedthis/goahead/security/advisories/GHSA-qj3g-66fp-rhhr) (embedthis/goahead)
- [GHSA-5m75-xq69-c3c5: OpenSSL CRL loaded but not enforced (CVE-2026-115881)](https://github.com/embedthis/goahead/security/advisories/GHSA-5m75-xq69-c3c5) (embedthis/goahead)
- [GHSA-584w-ph2x-4gfq: Windows CGI command injection via .bat / .cmd targets](https://github.com/embedthis/goahead/security/advisories/GHSA-584w-ph2x-4gfq) (embedthis/goahead)
- [GoAhead security advisories](https://github.com/embedthis/goahead/security) (embedthis/goahead)

## Write-ups & news
- [Choose Your Backend: Three TLS Bugs in GoAhead](https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead)
- [Sixteen fixes we found too late to report: our GoAhead investigation](https://www.blazeinfosec.com/labs/goahead-sixteen-fixes-independent-investigation)

---
Machine-readable: https://pwn.watch/i/goahead-6-1-1-tls-auth-cgi-flaws-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.