The Forged Gatekeeper
The server downloads the list of revoked certificates and never looks at it, so a cancelled one -- a stolen laptop, a leaked key -- still opens the door.
- Bestiary id
- 2026-B-0004
- Class
- FALSE GATE
- CVE
- CVE-2026-115881
- CVSS
- 9.1
- Published
- 2026-10-12
- Version
- v2
- Last updated
- 2026-10-27
- KEV
- not in KEV
Provisional card: built from the vendor advisory before NVD carried the record.
More information: https://github.com/embedthis/goahead/security/advisories/GHSA-5m75-xq69-c3c5