PT-2026-48467 · Ssl+1 · Ssl+1

Jakub Witczak + 2 · Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-48860

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 26.0 through 29.0.1 Erlang/OTP version 28.5.0.1 and earlier Erlang/OTP version 27.3.4.12 and earlier ssl versions 11.0 through 11.7.1 ssl version 11.6.0.1 and earlier ssl version 11.2.12.8 and earlier

Description An issue in the inet tls dist module allows an unauthenticated bypass of the LAN allowlist for Erlang distribution over TLS. The check ip() function incorrectly calls sockname() instead of peername() to retrieve the peer's IP address. Since sockname() returns the local socket address, the subnet mask comparison always succeeds regardless of the actual remote address. Consequently, any holder of a CA-signed TLS certificate can bypass LAN restrictions and gain full distribution access to the node, including the ability to use rpc:call() and code:load binary() functions.

Recommendations Update Erlang/OTP to version 29.0.2, 28.5.0.2, or 27.3.4.13. Update ssl to version 11.7.2, 11.6.0.2, or 11.2.12.9. Implement a custom verify fun SSL option that correctly checks the peer IP address using peername() on the socket.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-1025

CWE-863

Related Identifiers

CVE-2026-48860

GHSA-GP7X-MFV6-52CV

Affected Products

Erlang/Otp

Ssl

References · 6

• https://osv.dev/vulnerability/EEF-CVE-2026-48860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48860 · Security Note
• https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv · Vendor Advisory
• https://github.com/erlang/otp/commit/0209a6df65d605552b378273027b3968b35f26b4 · Patch
• https://cna.erlef.org/cves/CVE-2026-48860.html · Note
• https://erlang.org/doc/system/versions.html#order-of-versions · Note