Authorization Flaw in Erlangotp (CVE-2026-48860)
Summary
Vulnerability in Erlangotp (CVE-2026-48860). Confidential information can be exposed externally.
Original description
The description as published by the source.
Summary
Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.
The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3.
This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl.
This issue affects OTP from OTP 26.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2.
Workarounds
Implement a custom verify_fun SSL option that correctly checks the peer IP address using inet:peername/1 on the socket.
Configurations
The Erlang distribution must be configured to use TLS (inet_tls_dist) with the check_ip option enabled. The default Erlang distribution configuration does not use TLS and is not affected.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-48860 has been found in Erlangotp.
Confidential information can be exposed externally. CVSS score: 6.5/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "Erlangotp CVE-2026-48860" on the vendor's site.
CVE-2026-48860 (Erlangotp) — CWE-863 / CVSS v3 6.5
Attack vector: remote (network-reachable) / no user interaction
Workaround: Implement a custom verify_fun SSL option that correctly checks the peer IP address using inet:peername/1 on the socket.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Incorrect authorization (CWE-863) exists in Erlangotp.
Check the vendor advisory for the affected versions of Erlangotp.
Severity: Medium (CVSS 6.5/10). Confidential information can be exposed externally.
Update to the patched release per vendor advisory.
Workaround: Implement a custom verify_fun SSL option that correctly checks the peer IP address using inet:peername/1 on the socket.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'Erlangotp' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'Erlangotp' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
Erlangotpを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
Implement a custom verify\_fun SSL option that correctly checks the peer IP address using inet:peername/1 on the socket.パッチが適用されるまでの応急処置として、Implement a custom verify_fun SSL option that correctly checks the peer IP address using inet:peername/1 on the socket. を実施。回避策の副作用 (機能低下) を確認した上で。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-48860 erlang
- Ubuntu UBUNTU-CVE-2026-48860 erlang
References
- advisory github.com
- advisory osv.dev
- patch github.com
- web cna.erlef.org
- web erlang.org
- web github.com