Skip to main content

Erlang/OTP CVE-2026-48860

| EUVDEUVD-2026-36057 HIGH
Comparison Using Wrong Factors (CWE-1025)
2026-06-10 EEF
Authentication Bypass Otp
7.5
CVSS 4.0 · Vendor: EEF
Share

Severity by source

Vendor (EEF) PRIMARY
7.5 HIGH
CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
8.0 HIGH
AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat
6.8 MEDIUM
qualitative

Primary rating from Vendor (EEF).

CVSS VectorVendor: EEF

CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 10, 2026 - 16:35 vuln.today
Analysis Generated
Jun 10, 2026 - 16:35 vuln.today
CVSS changed
Jun 10, 2026 - 16:22 NVD
7.5 (HIGH)

DescriptionCVE.org

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.

The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3.

This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl.

This issue affects OTP from OTP 26.0 before 29.0.2, 28.5.0.2 and 27.3.4.13 corresponding to ssl from 11.0 before 11.7.2, 11.6.0.2 and 11.2.12.9.

AnalysisAI

Authentication bypass in Erlang/OTP's TLS distribution module (inet_tls_dist) lets any attacker holding a TLS certificate signed by a CA in the node's trust store gain full Erlang distribution access, including remote code execution via rpc:call/4 and code:load_binary/3. The flaw stems from check_ip/1 inspecting the local socket address (inet:sockname/1) instead of the peer's address (inet:peername/1), so the LAN-allowlist subnet comparison always matches. No public exploit identified at time of analysis, but the one-line root cause is fully disclosed in the upstream fix commit.

Technical ContextAI

Erlang/OTP nodes form distributed clusters via the Erlang distribution protocol; when TLS is used, the inet_tls_dist module handles authentication and admission control. A check_ip/1 routine in lib/ssl/src/inet_tls_dist.erl enforces an operator-configured LAN allowlist by AND-ing an IP with a subnet mask and comparing against the peer's address. The patch (commit 0209a6df) replaces inet:sockname(Socket) with inet:peername(Socket) - the prior code was reading the node's own bound address, so any remote peer always satisfied the check. This maps to CWE-1025 (Comparison Using Wrong Factors): the comparator logic is sound, but the wrong operand was supplied. The CPE strings indicate this affects the erlang:otp product across the listed version ranges, with the ssl application versions being the practical artifact users update.

RemediationAI

Vendor-released patches are available: upgrade to Erlang/OTP 29.0.2, 28.5.0.2, or 27.3.4.13 (matching ssl 11.7.2, 11.6.0.2, or 11.2.12.9) following the EEF advisory at https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv; the underlying one-line fix is commit 0209a6df65d605552b378273027b3968b35f26b4. If patching is delayed, restrict the TLS distribution listener's trust anchors to a private CA whose certificates are issued only to authorized cluster members - never rely on a public CA bundle, because the in-application LAN allowlist cannot be trusted on vulnerable builds; this requires regenerating and redistributing certificates to all legitimate nodes. Additionally, firewall the distribution port (typically epmd-allocated) so only known peer addresses can reach it, which restores a network-layer equivalent of the broken allowlist at the cost of tighter operational coordination when adding nodes.

More in Otp

View all
CVE-2022-24584 MEDIUM POC
6.5 May 11

Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation
CVE-2026-55953 CRITICAL
9.1 Jul 27

An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by th
CVE-2026-49759 HIGH
8.8 Jun 10

Denial of service in Erlang/OTP erts (inet_drv SCTP handler) lets unauthenticated remote attackers crash the BEAM VM by

CVE-2026-55950 HIGH
8.7 Jul 02

Remote denial of service in Erlang/OTP's ssl application (dtls_packet_demux module) lets an unauthenticated attacker cra
CVE-2026-58227 HIGH
8.7 Jul 27

Uncontrolled recursion in the Erlang/OTP ssl application when processing a crafted TLS/DTLS certificate chain allows rem
CVE-2026-59250 HIGH
8.3 Jul 27

We need to output a JSON object based on the CVE-2026-59250 data. We must synthesize from multiple sources: description,
CVE-2026-28808 HIGH
8.3 Apr 07

Authorization bypass in Erlang OTP's inets HTTP server allows unanauthenticated remote attackers to execute CGI scripts

CVE-2026-55952 HIGH
8.2 Jul 02

Denial of service in the Erlang/OTP ssl application (OTP 22.2 through 29.0.3, and the 28.5.x/27.3.x maintenance branches
CVE-2026-32144 HIGH
7.6 Apr 07

Erlang OTP public_key module (versions 1.16 through 1.20.3 and 1.17.1.2) fails to cryptographically verify OCSP responde
CVE-2026-48856 HIGH
7.1 Jun 10

Credential leakage in Erlang/OTP's inets httpc client (versions 17.0 through 29.0.2, 28.5.0.2, and 27.3.4.13) allows att
CVE-2026-23941 HIGH
7.0 Mar 13

A critical HTTP Request Smuggling vulnerability exists in Erlang OTP's inets httpd module that allows attackers to desyn
CVE-2026-23943 MEDIUM
6.9 Mar 13

A remote code execution vulnerability (CVSS 6.9) that allows denial of service. Remediation should follow standard vulne

Same weakness CWE-1025 – Comparison Using Wrong Factors

View all
CVE-2025-71377 HIGH
8.7
CVE-2024-20342 HIGH
8.6
CVE-2026-75840 HIGH
8.7
CVE-2026-9800 HIGH
8.1
CVE-2025-32464 MEDIUM
6.8
CVE-2026-40880 HIGH
7.2
CVE-2026-40227 MEDIUM
6.2
CVE-2025-2888 MEDIUM
5.7

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected

Share

CVE-2026-48860 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy