← Back to CVE Explorer

CVE-2026-48860

Full vulnerability record from the local CVENow database.

Description

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2.

Severity
HIGH
CVSS score
7.5 (v4.0)
Vulnerability status
Modified
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-06-10 16:17:12.503000
Last modified
2026-10-26 11:10:00.157000
View original CVE JSON 
{
  "id": "CVE-2026-48860",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-06-10T16:17:12.503",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.\n\nThe inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3.\n\nThis vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl.\n\nThis issue affects OTP from OTP 26.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de dependencia de la dirección IP para la autenticación en Erlang/OTP ssl (módulo inet_tls_dist) permite la omisión no autenticada de la lista de permitidos de la LAN de distribución sobre TLS.\n\nLa función inet_tls_dist:check_ip/1, que aplica una lista de permitidos de LAN para la distribución de Erlang sobre TLS, llama a inet:sockname/1 en lugar de inet:peername/1 para obtener la dirección IP del par. Debido a que inet:sockname/1 devuelve la dirección del socket local, tanto la IP local como la supuesta IP del par se resuelven al mismo valor, haciendo que la comparación de la máscara de subred siempre tenga éxito independientemente de la dirección remota real. Cualquier poseedor de un certificado TLS firmado por una CA puede, por lo tanto, omitir la restricción de LAN y obtener acceso completo de distribución de Erlang al nodo, incluyendo rpc:call/4 y code:load_binary/3.\n\nEsta vulnerabilidad está asociada con el archivo de programa lib/ssl/src/inet_tls_dist.erl.\n\nEste problema afecta a OTP desde OTP 26.0 antes de 29.0.2, 28.5.0.2 y 27.3.4.13 correspondiente a ssl desde 11.0 antes de 11.7.2, 11.6.0.2 y 11.2.12.9."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "Erlang",
          "product": "OTP",
          "defaultStatus": "unaffected",
          "packageName": "otp",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "inet_tls_dist"
          ],
          "programFiles": [
            "lib/ssl/src/inet_tls_dist.erl"
          ],
          "programRoutines": [
            {
              "name": "inet_tls_dist:check_ip/1"
            }
          ],
          "packageURL": "pkg:software-id/erlang.org/otp",
          "versions": [
            {
              "version": "26.0",
              "lessThan": "*",
              "versionType": "otp",
              "status": "affected",
              "changes": [
                {
                  "at": "27.3.4.13",
                  "status": "unaffected"
                },
                {
                  "at": "28.5.0.2",
                  "status": "unaffected"
                },
                {
                  "at": "29.0.2",
                  "status": "unaffected"
                }
              ]
            }
          ]
        },
        {
          "vendor": "Erlang",
          "product": "OTP",
          "defaultStatus": "unaffected",
          "packageName": "ssl",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "inet_tls_dist"
          ],
          "programFiles": [
            "src/inet_tls_dist.erl"
          ],
          "programRoutines": [
            {
              "name": "inet_tls_dist:check_ip/1"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
          "versions": [
            {
              "version": "11.0",
              "lessThan": "*",
              "versionType": "otp",
              "status": "affected",
              "changes": [
                {
                  "at": "11.2.12.9",
                  "status": "unaffected"
                },
                {
                  "at": "11.6.0.2",
                  "status": "unaffected"
                },
                {
                  "at": "11.7.2",
                  "status": "unaffected"
                }
              ]
            }
          ]
        },
        {
          "vendor": "Erlang",
          "product": "OTP",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "erlang/otp",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "inet_tls_dist"
          ],
          "programFiles": [
            "lib/ssl/src/inet_tls_dist.erl"
          ],
          "programRoutines": [
            {
              "name": "inet_tls_dist:check_ip/1"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "packageURL": "pkg:github/erlang/otp",
          "versions": [
            {
              "version": "7a08c5507862a7011568506d0c17b1fdef30bee4",
              "lessThan": "0209a6df65d605552b378273027b3968b35f26b4",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-10T16:23:08.922807Z",
          "id": "CVE-2026-48860",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        },
        {
          "lang": "en",
          "value": "CWE-1025"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "26.0",
              "versionEndExcluding": "27.3.4.13",
              "matchCriteriaId": "9F891113-4D35-4AB8-AA44-F3B6FC784F48"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "28.0",
              "versionEndExcluding": "28.5.0.2",
              "matchCriteriaId": "902ED4C3-B9DE-4ABC-9BEA-D23DA4F5D373"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "29.0",
              "versionEndExcluding": "29.0.2",
              "matchCriteriaId": "F4AB1573-4E81-4338-B65A-B3C94C7249FA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "11.0",
              "versionEndExcluding": "11.2.12.9",
              "matchCriteriaId": "0CA14B60-463E-40CC-912B-C7F2CA378F10"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "11.6",
              "versionEndExcluding": "11.6.0.2",
              "matchCriteriaId": "3B27962B-3148-468A-973A-9C1564E41697"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "11.7",
              "versionEndExcluding": "11.7.2",
              "matchCriteriaId": "39203B38-8145-4DC7-9624-2EB224B7E6AA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-48860.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/erlang/otp/commit/0209a6df65d605552b378273027b3968b35f26b4",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/erlang/otp/commit/7a08c5507862a7011568506d0c17b1fdef30bee4",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48860",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Product"
      ]
    }
  ]
}