Threat reportVulnerabilityTL-2026-4556
GoAhead Web Server TLS Vulnerabilities (CVE-2026-115881, CVE-2026-115884) Expose Embedded Devices
GoAhead Web Server TLS Vulnerabilities (CVE-2026-115881 (TL-2026-4556), also tracked as GOAHEAD-SA-2026-0004, is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-10-27. It has no confirmed attribution, affects Embedthis GoAhead Web Server (OpenSSL-compatible backend), references 2 CVEs (CVE-2026-115881, CVE-2026-115884), maps to 4 MITRE ATT&CK techniques (T1040, T1078, T1190), and is covered by 9 detection rules and 5 indicators of compromise.
- CVSS
- 9.1/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 5Indicators of compromise
Key facts for TL-2026-4556
- Threat ID
- TL-2026-4556
- Also known as
- GOAHEAD-SA-2026-0004, GOAHEAD-SA-2026-0005, GOAHEAD-SA-2026-0006, Choose Your Backend: Three TLS Bugs in GoAhead
- Severity
- CRITICAL
- CVSS
- 9.1
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- industrial, critical infrastructure, telecoms, technology, aerospace and defense, government administration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 5
Malware and tooling in GoAhead Web Server TLS Vulnerabilities (CVE-2026-115881
Malware and tooling: JA4Scan
How GoAhead Web Server TLS Vulnerabilities (CVE-2026-115881 works
Three backend-specific TLS integration flaws in the Embedthis GoAhead embedded web server allow revoked client certificates to be accepted (OpenSSL-compatible builds, CVSS 9.1), over-long certificate chains to pass validation (LibreSSL legacy verifier, CVSS 7.4), and a truncated Diffie-Hellman modulus that enables passive traffic decryption (Mbed TLS, CVSS 5.9). All are fixed in GoAhead 6.1.1; no in-the-wild exploitation has been reported.
FoxIO researcher Sebastien Fery disclosed three independent TLS flaws in GoAhead, a widely embedded web server used in network appliances, industrial and consumer devices. Each flaw lives in the glue code between GoAhead and a specific TLS backend, so exposure depends on the backend a vendor compiled in. FoxIO states the product family is deployed across hundreds of millions of devices from vendors including Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin and Boeing. The hunt source article names Palo Alto Networks, Siemens, Honeywell and Boeing.
Flaw 1 (CVE-2026-115881, GOAHEAD-SA-2026-0006, CVSS 9.1, GoAhead 3.4.5-6.1.0, OpenSSL-compatible backend): GoAhead loads a Certificate Revocation List but never sets the OpenSSL CRL check flag (X509_V_FLAG_CRL_CHECK), so OpenSSL returns success without consulting the list. With mutual TLS enabled (ME_GOAHEAD_SSL_VERIFY_PEER=1), a CRL configured (ME_GOAHEAD_SSL_REVOKE) and issuer verification enabled (ME_GOAHEAD_SSL_VERIFY_ISSUER=1), a previously trusted but revoked client identity retains access. The 6.1.1 fix adds X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK).
Flaw 2 (GOAHEAD-SA-2026-0005, CVSS 5.9, no CVE ID stated in sources, GoAhead 4.0.2-6.1.0, Mbed TLS backend): a buffer-length typo passes sizeof(dhm_g) for both the generator and the prime in mbedtls_ssl_conf_dh_param_bin. Because dhm_g is one byte, only the first byte (0xFF) of the 256-byte 2048-bit modulus is used. The shared secret then has only eight possible values (0x01, 0x02, 0x04 ... 0x80). A passive observer can try each candidate against captured TLS 1.2 DHE_RSA traffic; the FoxIO PoC recovered the correct secret within five attempts. OpenSSL clients reject the malformed parameters (modulus too small), so exposure depends on the client. Twenty-five DHE_RSA cipher suites are affected, including TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x009F). The fix passes sizeof(dhm_p) for the prime.
Flaw 3 (CVE-2026-115884, GOAHEAD-SA-2026-0004, CVSS 7.4, GoAhead up to 6.1.0, LibreSSL legacy verifier 3.2.x and 3.3.2-3.3.6): when client certificate verification is on but issuer verification is off (ME_GOAHEAD_SSL_VERIFY_PEER=1, ME_GOAHEAD_SSL_VERIFY_ISSUER=0), the legacy verifier stops building the chain without recording a depth error. GoAhead receives X509 error 20 (unable to get local issuer) instead of error 22 (chain too long). A 17-certificate chain from an attacker-controlled CA completed the handshake against GoAhead 6.1.0 with LibreSSL 3.3.6 and returned HTTP 200 for protected resources, although the depth limit is 10.
Timeline per FoxIO: reports to the LibreSSL, Mbed TLS and OpenSSL projects on 2026-04-22, 04-27 and 04-30; GoAhead 6.1.1 (a drop-in replacement for 6.1.0) released 2026-08-02; advisories published 2026-10-12; FoxIO blog 2026-10-26. The CVE-to-flaw mapping comes from the FoxIO blog; the CVE IDs could not be cross-verified in NVD or via search at research time, and the CVSS vectors are not stated in the sources. No exploitation in the wild, IOCs or attribution have been reported. Defenders can fingerprint GoAhead TLS stacks with FoxIO JA4Scan and hunt for DHE cipher suites in JA4S values.
MITRE ATT&CK techniques used in TL-2026-4556
Credential Access
T1040 Network Sniffing; T1557 Adversary-in-the-Middle
Discovery
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Defense Evasion
Persistence
Collection
Affected products and versions in GoAhead Web Server TLS Vulnerabilities (CVE-2026-115881
- Embedthis — GoAhead Web Server (OpenSSL-compatible backend)
Vulnerable versions: 3.4.5 through 6.1.0
Fixed in: 6.1.1 - Embedthis — GoAhead Web Server (Mbed TLS backend)
Vulnerable versions: 4.0.2 through 6.1.0
Fixed in: 6.1.1 - Embedthis — GoAhead Web Server (LibreSSL legacy verifier 3.2.x, 3.3.2-3.3.6)
Vulnerable versions: up to 6.1.0
Fixed in: 6.1.1 - Various OEMs (Palo Alto Networks, Siemens, Honeywell, Boeing, Comcast, D-Link, HP, Canon, GE, Oracle, Rockwell, Digi, Lockheed Martin per sources) — Embedded devices bundling GoAhead
Vulnerable versions: model-specific
Fixed in: vendor firmware with GoAhead 6.1.1
Remediation for GoAhead Web Server TLS Vulnerabilities (CVE-2026-115881
Patches
- Upgrade to GoAhead 6.1.1 or later (drop-in replacement for 6.1.0); obtain vendor firmware that bundles it
Immediate actions
- Inventory devices running GoAhead 3.2.x through 6.1.0 and identify the TLS backend (OpenSSL-compatible, Mbed TLS, LibreSSL) compiled into each
- Treat previously revoked client certificates as potentially still valid on OpenSSL-backed GoAhead devices with mTLS until patched; rotate the issuing CA or restrict network access to management interfaces
- Disable TLS 1.2 DHE_RSA cipher suites on Mbed TLS-backed devices where configurable
- Hunt TLS telemetry for DHE suites using the JA4S pattern *_0014_ (or other affected cipher codes) per FoxIO guidance
Workarounds
- LibreSSL builds: set ME_GOAHEAD_SSL_VERIFY_ISSUER=1 with a trusted CA bundle, or upgrade to LibreSSL 4.x
- Disable DHE suites on Mbed TLS builds
Longer-term hardening
- Restrict management-plane TLS endpoints of embedded devices to trusted networks
- Require vendors to provide SBOM and TLS backend details for embedded web servers
- Use JA4Scan to fingerprint TLS servers and verify patched builds
CVEs associated with GoAhead Web Server TLS Vulnerabilities (CVE-2026-115881
Timeline of GoAhead Web Server TLS Vulnerabilities (CVE-2026-115881
- FoxIO reports the chain-depth verifier issue to the LibreSSL project
- FoxIO reports the Diffie-Hellman parameter truncation to the Mbed TLS project
- FoxIO reports the CRL enforcement issue (OpenSSL backend)
- GoAhead 6.1.1 released as a drop-in replacement for 6.1.0 with fixes for all three flaws
- Advisories GOAHEAD-SA-2026-0004, -0005 and -0006 published
- FoxIO publishes the 'Choose Your Backend' blog with technical details, PoC and JA4Scan fingerprints
- Cyber Security News reports the flaws could expose hundreds of millions of devices
Sources cited for GoAhead Web Server TLS Vulnerabilities (CVE-2026-115881
Detection coverage for TL-2026-4556
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4556 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.