CVE-2026-48860

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-48860
Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cna.erlef.org/cves/CVE-2026-48860.html Third Party Advisory
https://github.com/erlang/otp/commit/0209a6df65d605552b378273027b3968b35f26b4 Patch
https://github.com/erlang/otp/commit/7a08c5507862a7011568506d0c17b1fdef30bee4
https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv Vendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-48860 Third Party Advisory
https://www.erlang.org/doc/system/versions.html#order-of-versions Product
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/ssl:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/ssl:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/ssl:*:*:*:*:*:*:*:*
History

26 Oct 2026, 11:10

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad de dependencia de la dirección IP para la autenticación en Erlang/OTP ssl (módulo inet_tls_dist) permite la omisión no autenticada de la lista de permitidos de la LAN de distribución sobre TLS. La función inet_tls_dist:check_ip/1, que aplica una lista de permitidos de LAN para la distribución de Erlang sobre TLS, llama a inet:sockname/1 en lugar de inet:peername/1 para obtener la dirección IP del par. Debido a que inet:sockname/1 devuelve la dirección del socket local, tanto la IP local como la supuesta IP del par se resuelven al mismo valor, haciendo que la comparación de la máscara de subred siempre tenga éxito independientemente de la dirección remota real. Cualquier poseedor de un certificado TLS firmado por una CA puede, por lo tanto, omitir la restricción de LAN y obtener acceso completo de distribución de Erlang al nodo, incluyendo rpc:call/4 y code:load_binary/3. Esta vulnerabilidad está asociada con el archivo de programa lib/ssl/src/inet_tls_dist.erl. Este problema afecta a OTP desde OTP 26.0 antes de 29.0.2, 28.5.0.2 y 27.3.4.13 correspondiente a ssl desde 11.0 antes de 11.7.2, 11.6.0.2 y 11.2.12.9.

24 Sep 2026, 21:17

Type Values Removed Values Added
References
  • () https://github.com/erlang/otp/commit/7a08c5507862a7011568506d0c17b1fdef30bee4 -
Summary (en) Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to ssl from 11.0 before 11.7.2, 11.6.0.2 and 11.2.12.9. (en) Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2.
Information

Published : 2026-06-10 16:17

Updated : 2026-10-26 11:10

NVD link : CVE-2026-48860

Mitre link : CVE-2026-48860

CVE.ORG link : CVE-2026-48860

JSON object : View

Products Affected

erlang

  • erlang\/otp
  • erlang\/ssl
CWE
CWE-863

Incorrect Authorization

CWE-1025

Comparison Using Wrong Factors