CVE-2026-115884
GoAhead mTLS chain-depth bypass on LibreSSL legacy-verifier builds
GoAhead up to 6.1.0 on LibreSSL 3.2.x or 3.3.2-3.3.6 can accept an over-long, self-signed client chain when issuer checks are off. Upgrade to 6.1.1 or set VERIFY_ISSUER=1. Not in CISA KEV.
By ThreatWire Desk · Published 12 Oct 2026 · Updated 27 Oct 2026
- CVSS
- 7.4
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Class
- Auth bypass
- Status
- PoC Available
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Embedthis
- Products
- GoAhead embedded web server (linked against LibreSSL legacy verifier)
- Affected
- GoAhead 6.1.0 and earlier linked against LibreSSL 3.2.x or 3.3.2 to 3.3.6, with ME_GOAHEAD_SSL_VERIFY_PEER=1 and ME_GOAHEAD_SSL_VERIFY_ISSUER=0.
- Fixed
- GoAhead 6.1.1 (shipped to device builders on 2 August 2026; advisory published 12 October 2026). OpenSSL, BoringSSL, AWS-LC, LibreSSL 4.x and mbedtls builds are not exposed.
- Published
- 12 Oct 2026
- Updated
- 27 Oct 2026
The status above is the claim. Links do not upgrade it.
What happened
An attacker can pass a GoAhead client-certificate check with no trusted key, on a narrow set of builds. The trick is a self-signed certificate chain longer than the server's limit of 10.
Old LibreSSL releases report that chain as an issuer error, not a depth error. GoAhead tolerates issuer errors when issuer checks are off, so the handshake completes. The depth guard in GoAhead's callback never fires.
Embedthis rates the flaw High, CVSS 3.1 7.4. It published advisory GHSA-r392-vqwx-3r4g on 12 October 2026. The fix, GoAhead 6.1.1, reached device builders on 2 August 2026.
Who is affected
Only GoAhead 6.1.0 and earlier linked against LibreSSL 3.2.x or 3.3.2 to 3.3.6 is exposed. Those releases use LibreSSL's legacy certificate verifier by default.
The build must also require client certificates (ME_GOAHEAD_SSL_VERIFY_PEER=1) and skip issuer checks (ME_GOAHEAD_SSL_VERIFY_ISSUER=0). Mutual TLS is off in default GoAhead builds.
Builds on OpenSSL, BoringSSL, AWS-LC, LibreSSL 4.x or mbedtls are not exposed, Embedthis says.
What is confirmed
The Embedthis advisory gives the affected range, the fixed release and the CWE ids, CWE-287, CWE-295 and CWE-754. Embedthis fixed the callback on every backend as defense in depth.
Sébastien Féry of FoxIO found the flaw and reported it on 22 April 2026. His write-up shows a 17-certificate chain accepted on GoAhead 6.1.0 with LibreSSL 3.3.6. LibreSSL 4.3.1 rejected the same chain. FoxIO published reproduction files, which we read but did not run.
CISA's Known Exploited Vulnerabilities catalog does not list this CVE (checked 27 October 2026).
What is not confirmed
No vendor or government source reports attacks. NVD has no entry yet, and CVE.org still shows the id as reserved. The only published score is the one from Embedthis.
We found no device maker advisory that names an affected product. Note that a build with issuer checks off already accepts ordinary self-signed client certificates by design.
What to do
- Upgrade GoAhead to 6.1.1 or later and rebuild your firmware, if you ship it.
- Set ME_GOAHEAD_SSL_VERIFY_ISSUER=1 with a trusted CA bundle wherever mutual TLS guards access.
- Move off LibreSSL 3.2.x and 3.3.x to LibreSSL 4.x or OpenSSL.
- Ask your device maker for firmware based on 6.1.1, if you run GoAhead-based gear.
Full context, including two related TLS flaws: GoAhead 6.1.1 fixes TLS flaws that let revoked certificates back in.