CVE-2026-48860

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to ssl from 11.0 before 11.7.2, 11.6.0.2 and 11.2.12.9.

• CWE-863
• CWE-1025

• https://cna.erlef.org/cves/CVE-2026-48860.htmlThird Party Advisory
• https://github.com/erlang/otp/commit/0209a6df65d605552b378273027b3968b35f26b4Patch
• https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cvVendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-48860Third Party Advisory
• https://www.erlang.org/doc/system/versions.html#order-of-versionsProduct

Published

Jun 10, 2026

Last Modified

Jul 24, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48853Deserialization of Untrusted Data and Allocation of Resource…9.2
• CVE-2026-48854Allocation of Resources Without Limits or Throttling vulnera…8.7
• CVE-2026-48855Exposure of Sensitive Information to an Unauthorized Actor v…6.5
• CVE-2026-48856Sensitive Data Exposure vulnerability in Erlang OTP inets (h…6.5
• CVE-2026-48858Server-Side Request Forgery (SSRF) vulnerability in Erlang/O…6.5
• CVE-2026-48859Observable Timing Discrepancy vulnerability in Erlang/OTP ss…5.3
• CVE-2026-48861Improper Neutralization of CRLF Sequences ('CRLF Injection')…2.1
• CVE-2026-48862Allocation of Resources Without Limits or Throttling vulnera…8.2
• CVE-2026-48863A flaw was found in libsolv. A stack-based buffer overflow v…7.5
• CVE-2026-48864A flaw was found in libsolv. This heap buffer overflow occur…7.8
• CVE-2026-48865Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-48866Improper Limitation of a Pathname to a Restricted Directory …9.6