CVE-2026-48860 Details
Description
Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2.
A vulnerability in the Erlang/OTP SSL module's inet_tls_dist component allows unauthorized bypass of the distribution-over-TLS LAN allowlist. This issue arises because the check_ip function incorrectly uses inet:sockname/1 to retrieve the peer's IP address, instead of the correct inet:peername/1. As a result, both the local and supposed peer IP addresses are the same, causing the subnet mask comparison to always succeed, regardless of the actual remote address. Consequently, any holder of a CA-signed TLS certificate can circumvent the LAN restriction and gain full Erlang distribution access to the node, including the ability to execute remote procedure calls and load binary code.
Upgrade to Erlang/OTP versions 29.0.2, 28.5.0.2, or 27.3.4.13. If an immediate upgrade is not possible, implement a custom verify_fun SSL option that correctly checks the peer IP address using inet:peername/1.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-48860.html | EEF | Third Party Advisory |
| https://github.com/erlang/otp/commit/0209a6df65d605552b378273027b3968b35f26b4 | EEF | Patch |
| https://github.com/erlang/otp/commit/7a08c5507862a7011568506d0c17b1fdef30bee4 | EEF | |
| https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv | EEF | Vendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-48860 | EEF | Third Party Advisory |
| https://www.erlang.org/doc/system/versions.html#order-of-versions | EEF | Product |
Weakness Enumeration
Affected Products
| Product | Versions |
|---|---|
| erlang erlang/otp | >= 26.0, < 27.3.4.13 >= 28.0, < 28.5.0.2 >= 29.0, < 29.0.2 |
CPE
Remediation
| |
| erlang erlang/ssl | >= 11.0, < 11.2.12.9 >= 11.6, < 11.6.0.2 >= 11.7, < 11.7.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | EEF |
| Jul 24, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | EEF |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 10, 2026 | New CVE Received | EEF |