CVE-2026-48860

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48860", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-05-25T20:44:10.697Z", "datePublished": "2026-06-10T14:35:49.987Z", "dateUpdated": "2026-09-24T20:39:54.903Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["inet_tls_dist"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/ssl/src/inet_tls_dist.erl"], "programRoutines": [{"name": "inet_tls_dist:check_ip/1"}], "vendor": "Erlang", "versions": [{"changes": [{"at": "27.3.4.13", "status": "unaffected"}, {"at": "28.5.0.2", "status": "unaffected"}, {"at": "29.0.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "26.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["inet_tls_dist"], "packageName": "ssl", "packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/inet_tls_dist.erl"], "programRoutines": [{"name": "inet_tls_dist:check_ip/1"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "11.2.12.9", "status": "unaffected"}, {"at": "11.6.0.2", "status": "unaffected"}, {"at": "11.7.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "11.0", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["inet_tls_dist"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/ssl/src/inet_tls_dist.erl"], "programRoutines": [{"name": "inet_tls_dist:check_ip/1"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"lessThan": "0209a6df65d605552b378273027b3968b35f26b4", "status": "affected", "version": "7a08c5507862a7011568506d0c17b1fdef30bee4", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The Erlang distribution must be configured to use TLS (<code>inet_tls_dist</code>) with the <code>check_ip</code> option enabled. The default Erlang distribution configuration does not use TLS and is not affected.</p>"}, {"base64": false, "type": "text/markdown", "value": "The Erlang distribution must be configured to use TLS (`inet_tls_dist`) with the `check_ip` option enabled. The default Erlang distribution configuration does not use TLS and is not affected."}], "value": "The Erlang distribution must be configured to use TLS (inet_tls_dist) with the check_ip option enabled. The default Erlang distribution configuration does not use TLS and is not affected."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "27.3.4.13", "versionStartIncluding": "26.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "28.5.0.2", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "29.0.2", "versionStartIncluding": "29.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Lukas Backstr\u00f6m"}, {"lang": "en", "type": "remediation developer", "value": "Ingela Anderton Andin"}, {"lang": "en", "type": "remediation reviewer", "value": "Raimo Niskanen"}, {"lang": "en", "type": "remediation reviewer", "value": "Jakub Witczak"}], "datePublic": "2026-06-10T14:35:49.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.</p>\n<p>The <code>inet_tls_dist:check_ip/1</code> function, which enforces a LAN allowlist for Erlang distribution over TLS, calls <code>inet:sockname/1</code> instead of <code>inet:peername/1</code> to obtain the peer's IP address. Because <code>inet:sockname/1</code> returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including <code>rpc:call/4</code> and <code>code:load_binary/3</code>.</p>\n<p>This vulnerability is associated with program file <code>lib/ssl/src/inet_tls_dist.erl</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;26.0 before OTP&nbsp;27.3.4.13, OTP&nbsp;28.5.0.2, and OTP&nbsp;29.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2.</p>"}, {"base64": false, "type": "text/markdown", "value": "Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.\n\nThe `inet_tls_dist:check_ip/1` function, which enforces a LAN allowlist for Erlang distribution over TLS, calls `inet:sockname/1` instead of `inet:peername/1` to obtain the peer's IP address. Because `inet:sockname/1` returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including `rpc:call/4` and `code:load_binary/3`.\n\nThis vulnerability is associated with program file `lib/ssl/src/inet_tls_dist.erl`.\n\nThis issue affects OTP from OTP\u00a026.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2."}], "value": "Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.\n\nThe inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3.\n\nThis vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl.\n\nThis issue affects OTP from OTP\u00a026.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}, {"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "baseScore": 7.5, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1025", "description": "CWE-1025 Comparison Using Wrong Factors", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-24T20:39:54.903Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv"}, {"name": "EEF CNA record for CVE-2026-48860", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-48860.html"}, {"name": "OSV record EEF-CVE-2026-48860", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48860"}, {"name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"name": "Introducing commit 7a08c55 in erlang/otp", "tags": ["related"], "url": "https://github.com/erlang/otp/commit/7a08c5507862a7011568506d0c17b1fdef30bee4"}, {"name": "Fix commit 0209a6d in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/0209a6df65d605552b378273027b3968b35f26b4"}], "source": {"discovery": "INTERNAL"}, "title": "Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Implement a custom <code>verify_fun</code> SSL option that correctly checks the peer IP address using <code>inet:peername/1</code> on the socket.</p>"}, {"base64": false, "type": "text/markdown", "value": "Implement a custom `verify_fun` SSL option that correctly checks the peer IP address using `inet:peername/1` on the socket."}], "value": "Implement a custom verify_fun SSL option that correctly checks the peer IP address using inet:peername/1 on the socket."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-10T16:23:08.922807Z", "id": "CVE-2026-48860", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T16:23:31.951Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48860", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-10T16:23:08.922807Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T16:23:27.427Z"}}], "cna": {"title": "Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Lukas Backstr\u00f6m"}, {"lang": "en", "type": "remediation developer", "value": "Ingela Anderton Andin"}, {"lang": "en", "type": "remediation reviewer", "value": "Raimo Niskanen"}, {"lang": "en", "type": "remediation reviewer", "value": "Jakub Witczak"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}, {"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "vendor": "Erlang", "modules": ["inet_tls_dist"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "27.3.4.13", "status": "unaffected"}, {"at": "28.5.0.2", "status": "unaffected"}, {"at": "29.0.2", "status": "unaffected"}], "version": "26.0", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:software-id/erlang.org/otp", "packageName": "otp", "programFiles": ["lib/ssl/src/inet_tls_dist.erl"], "defaultStatus": "unaffected", "programRoutines": [{"name": "inet_tls_dist:check_ip/1"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["inet_tls_dist"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "11.2.12.9", "status": "unaffected"}, {"at": "11.6.0.2", "status": "unaffected"}, {"at": "11.7.2", "status": "unaffected"}], "version": "11.0", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "ssl", "programFiles": ["src/inet_tls_dist.erl"], "defaultStatus": "unaffected", "programRoutines": [{"name": "inet_tls_dist:check_ip/1"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["inet_tls_dist"], "product": "OTP", "versions": [{"status": "affected", "version": "7a08c5507862a7011568506d0c17b1fdef30bee4", "lessThan": "0209a6df65d605552b378273027b3968b35f26b4", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "programFiles": ["lib/ssl/src/inet_tls_dist.erl"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "inet_tls_dist:check_ip/1"}]}], "datePublic": "2026-06-10T14:35:49.000Z", "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-48860.html", "name": "EEF CNA record for CVE-2026-48860", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48860", "name": "OSV record EEF-CVE-2026-48860", "tags": ["related"]}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"]}, {"url": "https://github.com/erlang/otp/commit/7a08c5507862a7011568506d0c17b1fdef30bee4", "name": "Introducing commit 7a08c55 in erlang/otp", "tags": ["related"]}, {"url": "https://github.com/erlang/otp/commit/0209a6df65d605552b378273027b3968b35f26b4", "name": "Fix commit 0209a6d in erlang/otp", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Implement a custom verify_fun SSL option that correctly checks the peer IP address using inet:peername/1 on the socket.", "supportingMedia": [{"type": "text/html", "value": "<p>Implement a custom <code>verify_fun</code> SSL option that correctly checks the peer IP address using <code>inet:peername/1</code> on the socket.</p>", "base64": false}, {"type": "text/markdown", "value": "Implement a custom `verify_fun` SSL option that correctly checks the peer IP address using `inet:peername/1` on the socket.", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.\n\nThe inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3.\n\nThis vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl.\n\nThis issue affects OTP from OTP\u00a026.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2.", "supportingMedia": [{"type": "text/html", "value": "<p>Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.</p>\n<p>The <code>inet_tls_dist:check_ip/1</code> function, which enforces a LAN allowlist for Erlang distribution over TLS, calls <code>inet:sockname/1</code> instead of <code>inet:peername/1</code> to obtain the peer's IP address. Because <code>inet:sockname/1</code> returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including <code>rpc:call/4</code> and <code>code:load_binary/3</code>.</p>\n<p>This vulnerability is associated with program file <code>lib/ssl/src/inet_tls_dist.erl</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;26.0 before OTP&nbsp;27.3.4.13, OTP&nbsp;28.5.0.2, and OTP&nbsp;29.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2.</p>", "base64": false}, {"type": "text/markdown", "value": "Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.\n\nThe `inet_tls_dist:check_ip/1` function, which enforces a LAN allowlist for Erlang distribution over TLS, calls `inet:sockname/1` instead of `inet:peername/1` to obtain the peer's IP address. Because `inet:sockname/1` returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including `rpc:call/4` and `code:load_binary/3`.\n\nThis vulnerability is associated with program file `lib/ssl/src/inet_tls_dist.erl`.\n\nThis issue affects OTP from OTP\u00a026.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1025", "description": "CWE-1025 Comparison Using Wrong Factors"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "configurations": [{"lang": "en", "value": "The Erlang distribution must be configured to use TLS (inet_tls_dist) with the check_ip option enabled. The default Erlang distribution configuration does not use TLS and is not affected.", "supportingMedia": [{"type": "text/html", "value": "<p>The Erlang distribution must be configured to use TLS (<code>inet_tls_dist</code>) with the <code>check_ip</code> option enabled. The default Erlang distribution configuration does not use TLS and is not affected.</p>", "base64": false}, {"type": "text/markdown", "value": "The Erlang distribution must be configured to use TLS (`inet_tls_dist`) with the `check_ip` option enabled. The default Erlang distribution configuration does not use TLS and is not affected.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.3.4.13", "versionStartIncluding": "26.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.5.0.2", "versionStartIncluding": "28.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "29.0.2", "versionStartIncluding": "29.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-24T20:39:54.903Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48860", "state": "PUBLISHED", "dateUpdated": "2026-09-24T20:39:54.903Z", "dateReserved": "2026-05-25T20:44:10.697Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-06-10T14:35:49.987Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["inet_tls_dist"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/ssl/src/inet_tls_dist.erl"], "programRoutines": [{"name": "inet_tls_dist:check_ip/1"}], "vendor": "Erlang", "versions": [{"changes": [{"at": "27.3.4.13", "status": "unaffected"}, {"at": "28.5.0.2", "status": "unaffected"}, {"at": "29.0.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "26.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["inet_tls_dist"], "packageName": "ssl", "packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/inet_tls_dist.erl"], "programRoutines": [{"name": "inet_tls_dist:check_ip/1"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "11.2.12.9", "status": "unaffected"}, {"at": "11.6.0.2", "status": "unaffected"}, {"at": "11.7.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "11.0", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["inet_tls_dist"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/ssl/src/inet_tls_dist.erl"], "programRoutines": [{"name": "inet_tls_dist:check_ip/1"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"lessThan": "0209a6df65d605552b378273027b3968b35f26b4", "status": "affected", "version": "7a08c5507862a7011568506d0c17b1fdef30bee4", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F891113-4D35-4AB8-AA44-F3B6FC784F48", "versionEndExcluding": "27.3.4.13", "versionStartIncluding": "26.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "902ED4C3-B9DE-4ABC-9BEA-D23DA4F5D373", "versionEndExcluding": "28.5.0.2", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "F4AB1573-4E81-4338-B65A-B3C94C7249FA", "versionEndExcluding": "29.0.2", "versionStartIncluding": "29.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "0CA14B60-463E-40CC-912B-C7F2CA378F10", "versionEndExcluding": "11.2.12.9", "versionStartIncluding": "11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B27962B-3148-468A-973A-9C1564E41697", "versionEndExcluding": "11.6.0.2", "versionStartIncluding": "11.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "39203B38-8145-4DC7-9624-2EB224B7E6AA", "versionEndExcluding": "11.7.2", "versionStartIncluding": "11.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.\n\nThe inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3.\n\nThis vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl.\n\nThis issue affects OTP from OTP\u00a026.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2."}, {"lang": "es", "value": "La vulnerabilidad de dependencia de la direcci\u00f3n IP para la autenticaci\u00f3n en Erlang/OTP ssl (m\u00f3dulo inet_tls_dist) permite la omisi\u00f3n no autenticada de la lista de permitidos de la LAN de distribuci\u00f3n sobre TLS.\n\nLa funci\u00f3n inet_tls_dist:check_ip/1, que aplica una lista de permitidos de LAN para la distribuci\u00f3n de Erlang sobre TLS, llama a inet:sockname/1 en lugar de inet:peername/1 para obtener la direcci\u00f3n IP del par. Debido a que inet:sockname/1 devuelve la direcci\u00f3n del socket local, tanto la IP local como la supuesta IP del par se resuelven al mismo valor, haciendo que la comparaci\u00f3n de la m\u00e1scara de subred siempre tenga \u00e9xito independientemente de la direcci\u00f3n remota real. Cualquier poseedor de un certificado TLS firmado por una CA puede, por lo tanto, omitir la restricci\u00f3n de LAN y obtener acceso completo de distribuci\u00f3n de Erlang al nodo, incluyendo rpc:call/4 y code:load_binary/3.\n\nEsta vulnerabilidad est\u00e1 asociada con el archivo de programa lib/ssl/src/inet_tls_dist.erl.\n\nEste problema afecta a OTP desde OTP 26.0 antes de 29.0.2, 28.5.0.2 y 27.3.4.13 correspondiente a ssl desde 11.0 antes de 11.7.2, 11.6.0.2 y 11.2.12.9."}], "id": "CVE-2026-48860", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48860", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-10T16:23:08.922807Z", "version": "2.0.3"}}]}, "published": "2026-06-10T16:17:12.503", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-48860.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/0209a6df65d605552b378273027b3968b35f26b4"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/7a08c5507862a7011568506d0c17b1fdef30bee4"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48860"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Product"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}, {"lang": "en", "value": "CWE-1025"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{"bugzilla": {"description": "erlang: Erlang/OTP: Authentication bypass allows arbitrary code execution via improper IP address validation", "id": "2487597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487597"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-303", "details": ["A flaw was found in Erlang/OTP. The `inet_tls_dist:check_ip/1` function, responsible for enforcing a LAN allowlist for Erlang distribution over TLS, incorrectly uses `inet:sockname/1` instead of `inet:peername/1` to obtain the peer's IP address. This allows an unauthenticated attacker, possessing a CA-signed TLS certificate, to bypass the LAN restriction. Consequently, the attacker can gain full Erlang distribution access to the node, enabling remote procedure calls and arbitrary code loading."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict network access to the Erlang distribution port (default 4369) to only trusted hosts and networks using firewall rules. If Erlang distribution over TLS is not essential for your deployment, consider disabling it.\nExample using `firewalld` to limit access to port 4369:\n```bash\nsudo firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" port port=\"4369\" protocol=\"tcp\" source address=\"<TRUSTED_IP_OR_NETWORK>\" accept'\nsudo firewall-cmd --reload\n```\nReplace `<TRUSTED_IP_OR_NETWORK>` with the specific IP address or network range that should be allowed to access the Erlang distribution. This may impact the functionality of services relying on Erlang distribution from untrusted networks."}, "name": "CVE-2026-48860", "package_state": [{"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-06-10T14:35:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48860\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48860\nhttps://cna.erlef.org/cves/CVE-2026-48860.html\nhttps://github.com/erlang/otp/commit/0209a6df65d605552b378273027b3968b35f26b4\nhttps://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv\nhttps://osv.dev/vulnerability/EEF-CVE-2026-48860\nhttps://www.erlang.org/doc/system/versions.html#order-of-versions"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[11.0,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "11.7.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "11.6.0.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "11.2.12.9"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[26.0,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "29.0.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "28.5.0.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "27.3.4.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7a08c5507862a7011568506d0c17b1fdef30bee4,0209a6df65d605552b378273027b3968b35f26b4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}], "created": "2026-06-10T17:30:36.301501+00:00", "updated": "2026-09-26T06:30:03.499779+00:00", "vendors": ["erlang", "erlang$PRODUCT$otp"]}