← Vulnerability feed

Vulnerability record · CVE-2026-48860 · published 10 June 2026

CVE-2026-48860: Erlang\/otp incorrect authorization vulnerability

Erlang · Erlang\/Otp

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2.

7.5 CVSS 4.0 High EPSS 0.38% · top 70.7% CWE-863 · Incorrect authorizationCWE-1025 · CWE-1025
7.5CVSS 4.0 base score
0.38%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
6References
24 Sep 2026Last modified by NVD

Description

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2.

CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://cna.erlef.org/cves/CVE-2026-48860.html Third Party Advisory
https://github.com/erlang/otp/commit/0209a6df65d605552b378273027b3968b35f26b4 Patch
https://github.com/erlang/otp/commit/7a08c5507862a7011568506d0c17b1fdef30bee4
https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv Vendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-48860 Third Party Advisory
https://www.erlang.org/doc/system/versions.html#order-of-versions Product

Track CVE-2026-48860 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2025-32433Erlang/OTP SSH server missing authentication allows remote code executionErlang/OTP SSH servers before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20 mishandle SSH protocol messages, letting an unauthenticated attacker execut…KEVEPSS 99%analysed9.8CVE-2022-37026Erlang\/otp vulnerabilityIn Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification…EPSS 1.5%9.8CVE-2016-10253Erlang\/otp memory buffer overflow vulnerabilityAn issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions…EPSS 1.5%9.1CVE-2026-55953Erlang\/otp vulnerabilityThe Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the su…EPSS 0.37%8.8CVE-2026-49759Erlang\/otp stack-based buffer overflow vulnerabilityStack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a c…EPSS 0.86%8.7CVE-2026-59251Erlang\/otp allocation without limits vulnerabilityAllocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial …EPSS 0.52%8.7CVE-2026-58227Erlang\/otp vulnerabilityThe Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl…EPSS 0.67%8.7CVE-2026-55950Erlang\/otp toctou race condition vulnerabilityTime-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an unauthenticated remote attacke…EPSS 0.68%

Source: NIST National Vulnerability Database (record CVE-2026-48860), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.