Skip to main content

Erlang/OTP CVE-2026-48860

| EUVDEUVD-2026-36057 HIGH
Comparison Using Wrong Factors (CWE-1025)
2026-06-10 EEF
Authentication Bypass Otp Erlang
7.5
CVSS 4.0 · Vendor: EEF
Share

Severity by source

Vendor (EEF) PRIMARY
7.5 HIGH
CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
8.0 HIGH
AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat
6.8 MEDIUM
qualitative

Primary rating from Vendor (EEF).

CVSS VectorVendor: EEF

Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 10, 2026 - 16:35 vuln.today
Analysis Generated
Jun 10, 2026 - 16:35 vuln.today
CVSS changed
Jun 10, 2026 - 16:22 NVD
7.5 (HIGH)

DescriptionCVE.org

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.

The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3.

This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl.

This issue affects OTP from OTP 26.0 before 29.0.2, 28.5.0.2 and 27.3.4.13 corresponding to ssl from 11.0 before 11.7.2, 11.6.0.2 and 11.2.12.9.

AnalysisAI

Authentication bypass in Erlang/OTP's TLS distribution module (inet_tls_dist) lets any attacker holding a TLS certificate signed by a CA in the node's trust store gain full Erlang distribution access, including remote code execution via rpc:call/4 and code:load_binary/3. The flaw stems from check_ip/1 inspecting the local socket address (inet:sockname/1) instead of the peer's address (inet:peername/1), so the LAN-allowlist subnet comparison always matches. No public exploit identified at time of analysis, but the one-line root cause is fully disclosed in the upstream fix commit.

Technical ContextAI

Erlang/OTP nodes form distributed clusters via the Erlang distribution protocol; when TLS is used, the inet_tls_dist module handles authentication and admission control. A check_ip/1 routine in lib/ssl/src/inet_tls_dist.erl enforces an operator-configured LAN allowlist by AND-ing an IP with a subnet mask and comparing against the peer's address. The patch (commit 0209a6df) replaces inet:sockname(Socket) with inet:peername(Socket) - the prior code was reading the node's own bound address, so any remote peer always satisfied the check. This maps to CWE-1025 (Comparison Using Wrong Factors): the comparator logic is sound, but the wrong operand was supplied. The CPE strings indicate this affects the erlang:otp product across the listed version ranges, with the ssl application versions being the practical artifact users update.

RemediationAI

Vendor-released patches are available: upgrade to Erlang/OTP 29.0.2, 28.5.0.2, or 27.3.4.13 (matching ssl 11.7.2, 11.6.0.2, or 11.2.12.9) following the EEF advisory at https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv; the underlying one-line fix is commit 0209a6df65d605552b378273027b3968b35f26b4. If patching is delayed, restrict the TLS distribution listener's trust anchors to a private CA whose certificates are issued only to authorized cluster members - never rely on a public CA bundle, because the in-application LAN allowlist cannot be trusted on vulnerable builds; this requires regenerating and redistributing certificates to all legitimate nodes. Additionally, firewall the distribution port (typically epmd-allocated) so only known peer addresses can reach it, which restores a network-layer equivalent of the broken allowlist at the cost of tighter operational coordination when adding nodes.

More in Otp

View all
CVE-2022-24584 MEDIUM POC
6.5 May 11

Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation
CVE-2026-89422 CRITICAL
9.3 Sep 22

Erlang/OTP's ssl application in affected releases (OTP 22.2 through the fixed 27.3.4.18, 28.5.0.7 and 29.1.1) will compl
CVE-2026-55953 CRITICAL
9.1 Jul 27

An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by th
CVE-2026-49759 HIGH
8.8 Jun 10

Denial of service in Erlang/OTP erts (inet_drv SCTP handler) lets unauthenticated remote attackers crash the BEAM VM by

CVE-2026-70399 HIGH
8.7 Sep 01

Unauthenticated denial of service in Erlang/OTP's inets httpd allows any remote attacker to exhaust a server's process p
CVE-2026-55950 HIGH
8.7 Jul 02

Remote denial of service in Erlang/OTP's ssl application (dtls_packet_demux module) lets an unauthenticated attacker cra
CVE-2026-71380 HIGH
8.7 Sep 01

Erlang/OTP's inets HTTP server (httpd) is vulnerable to a slow-body resource exhaustion attack exploitable by unauthenti
CVE-2026-58227 HIGH
8.7 Jul 27

Uncontrolled recursion in the Erlang/OTP ssl application when processing a crafted TLS/DTLS certificate chain allows rem
CVE-2026-74835 HIGH
8.7 Sep 01

Erlang/OTP's inets HTTP server (httpd) fails to enforce an administrator-configured request body-size limit when process
CVE-2026-59250 HIGH
8.3 Jul 27

Remote code execution and denial of service are possible against Erlang/OTP nodes that run the megaco application with t
CVE-2026-73276 HIGH
8.3 Sep 01

Remote unauthenticated attackers can exploit Erlang/OTP's built-in inets HTTP server across OTP versions 22.2 through 29
CVE-2026-66357 HIGH
8.3 Sep 01

HTTP request smuggling in Erlang/OTP's built-in inets httpd server allows unauthenticated remote attackers to inject arb

Same weakness CWE-1025 – Comparison Using Wrong Factors

View all
CVE-2025-71377 HIGH
8.7
CVE-2026-75840 HIGH
8.7
CVE-2024-20342 HIGH
8.6
CVE-2026-100248 HIGH
8.4
CVE-2026-9800 HIGH
8.1
CVE-2026-104048 HIGH
8.1
CVE-2026-29811 HIGH
7.7
CVE-2025-32464 MEDIUM
6.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected

Share

CVE-2026-48860 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy