GoAhead Embedded Web Server Flaws Fixed in 6.1.1: What OT Owners Should Ask Their Vendors

On 12 October 2026, Embedthis, the company that maintains the GoAhead embedded web server, published eleven security advisories, all fixed in GoAhead version 6.1.1. On 26 October 2026, researcher Sébastien Féry of the security firm FoxIO published a detailed write-up of three of them, and the story has spread quickly since. GoAhead is the small web server built into many devices so that people can manage them from a web browser. According to FoxIO, it runs in hundreds of millions of Internet of Things (IoT), firewall, operational technology (OT) and military devices, and FoxIO names Siemens, Rockwell, Honeywell, GE, Digi, Palo Alto Networks and others among the manufacturers that use it. No exploitation in attacks has been reported so far.

The catch is that you cannot patch GoAhead yourself. It is compiled into each manufacturer's firmware, so a device gets the fix when its manufacturer ships a new firmware release built on GoAhead 6.1.1. That is why the Red Tiger team is treating this as a vendor follow-up item for every plant.

What the most serious flaws do, according to the Embedthis advisories:

• Login bypass, CVE-2026-115888, rated 9.8 out of 10 (Critical) under the Common Vulnerability Scoring System (CVSS). In GoAhead 6.1.0, users whose passwords are stored with the older Blowfish hash format (marked BF1) can be logged in with any password, through both the browser pop-up login and the web form login.
• Revoked certificates still accepted, CVE-2026-115881, rated 9.1 (Critical). Some devices use mutual Transport Layer Security (mTLS), where the client must present a digital certificate to connect. A certificate revocation list (CRL) is the list of certificates that have been cancelled, for example after a laptop is lost or an employee leaves. In GoAhead 3.4.5 through 6.1.0 built with OpenSSL, the device loads that list but never checks it, so a cancelled certificate still gets in.
• Command injection on Windows, rated 9.8 (Critical, no CVE number yet). On Windows builds, web requests that run .bat or .cmd scripts through the Windows command prompt can be used to run other commands on the host.
• Certificate chain limit skipped, CVE-2026-115884, rated 7.4 (High). Builds that use the older LibreSSL certificate checker can accept a client certificate chain that is longer than the configured limit when issuer checking is turned off.
• Weak encryption on Mbed TLS builds, rated 5.9 (Medium, no CVE number yet). On builds that use the Mbed TLS encryption library, a typo shrinks the key exchange number from 2,048 bits to a single byte. If an older or embedded client accepts it, someone who simply records the network traffic can later decrypt the whole session. Modern browsers and current OpenSSL, Go and Java clients refuse the broken setting.

The other advisories cover web script argument and environment injection (CVE-2026-115880 and CVE-2026-115882), HTTP request smuggling, where a crafted request is read differently by two systems, a digest login flaw that leaks a server secret, and session fixation, where the login session ID is not changed after sign-in. All are fixed in 6.1.1.

Where GoAhead shows up, from the plant floor to the cloud: Look for it anywhere a device has a built-in web page for setup or status. On the plant floor that means programmable logic controller (PLC) communication modules, remote input and output racks, drives, protocol gateways and serial-to-Ethernet converters. In the network, it means industrial switches, routers, cellular modems and firewall management pages. In the control room and the building, it means uninterruptible power supplies, power distribution units, printers, cameras and building management controllers. At the edge, it means remote access appliances and cloud-connected gateways that technicians and vendors log in to from outside. Whether a given product uses GoAhead, and which version and encryption library it uses, is something only the manufacturer can confirm.

What the Red Tiger team recommends:

1. Ask your vendors. Send your original equipment manufacturers (OEMs) and integrators a short question for each networked device: does the firmware include GoAhead, which version, which encryption library, and when will a release with 6.1.1 be available? Ask for a software bill of materials (SBOM), which is a list of the components inside a product.
2. Close the doors while you wait. Make sure no device web page can be reached from the internet or the business network. Allow management access only from a jump server or engineering workstation, through a firewall and a virtual private network (VPN), and turn off web management on devices that do not need it.
3. Check the settings you control. Remove or reset any old local accounts, change default passwords, and where a device lets you choose, prefer the newer TLS 1.3 encryption, or the elliptic-curve key exchange settings (ECDHE), over the older finite-field key exchange settings (DHE). If you rely on client certificates, do not count on revocation alone; remove a lost or departed user's access on the device itself.
4. Patch and watch. Schedule the vendor firmware updates through normal change control and test them before rollout. Until then, watch for logins to device web pages from unexpected addresses and for configuration changes nobody requested.

With 500+ assessments across critical infrastructure, the Red Tiger Security team helps owners build a plant-safe inventory of embedded components like GoAhead, chase vendors for fixed firmware, and lock down management access from the plant floor to the cloud.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources: Embedthis GoAhead security advisories, 12 October 2026: https://github.com/embedthis/goahead/security/advisories

FoxIO, "Choose Your Backend: Three TLS Bugs in GoAhead," 26 October 2026: https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead

GoAhead 6.1.1 release notes: https://github.com/embedthis/goahead/releases

‍