Erlang OTP inets CVE-2026-66835

Exploitation requires that the target runs Erlang/OTP's inets httpd with at least one mod_auth directory-protection block explicitly defined in the httpd configuration. Deployments that do not use inets as an HTTP server, or that use inets httpd without mod_auth directory blocks, are entirely unaffected-there is no authentication mechanism to bypass. The attack is network-accessible with no credentials or user interaction required (CVSS PR:N/UI:N confirmed by CVSS 4.0 vector). Limiting factors: (1) inets httpd is not a default-enabled component of OTP-it must be explicitly started and configured; (2) only confidentiality is impacted-the attacker can read files served by mod_get but cannot write, delete, or execute; (3) the same bypass also defeats mod_security per-path accounting, but that is a secondary effect of the same root cause; (4) OTP before 17.0 may or may not be affected-the vendor has not confirmed this range. On case-sensitive filesystems (Linux), case variations in the path do not additionally bypass mod_auth after the fix adds caseless regex matching, but prior to patching, case-only bypass via the same mechanism may apply on case-insensitive filesystems.

The CVSS 4.0 base score of 8.2 reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-interaction (UI:N) attack producing high confidentiality impact (VC:H) with no integrity or availability loss. The AT:P (Attack Requirements: Present) modifier accurately captures the key gating condition: a mod_auth directory-protection block must be explicitly configured. Deployments that do not use inets httpd or do not configure mod_auth are entirely unaffected, meaningfully lowering real-world exposure relative to the raw score. No EPSS data was supplied in the source intelligence, so exploitation probability cannot be quantified numerically; however, the manipulation-prepending a slash to a URL-is trivially reproducible from the public description alone, making opportunistic exploitation straightforward once an operator identifies a vulnerable inets httpd instance. No CISA KEV listing is present, and no public exploit code has been identified, so this is not a confirmed in-the-wild campaign. Defenders running inets httpd with mod_auth, particularly on internet-facing endpoints, should treat this as a genuine near-term patching priority; teams running OTP without inets httpd can deprioritize.

An attacker targeting an inets httpd deployment sends a plain HTTP GET request to //protected/secret.conf (or any variant with extra leading or intra-path slashes, e.g., /protected//secret.conf). The httpd URI normalizer passes the doubled slash through unchanged, mod_auth's unanchored regex fails to match the protected directory prefix, no 401 challenge is issued, and mod_get serves the file after the OS silently normalizes the path. No credentials, prior reconnaissance, or special tooling are required beyond knowing that the target runs inets httpd with a mod_auth-protected directory; no public exploit code has been identified, but the technique is directly derivable from the published description.