CVE-2026-48860

Name	CVE-2026-48860
Description	Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before 29.0.2, 28.5.0.2 and 27.3.4.13 corresponding to ssl from 11.0 before 11.7.2, 11.6.0.2 and 11.2.12.9.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1139727

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
erlang (PTS)	bullseye	1:23.2.6+dfsg-1+deb11u1	vulnerable
	bullseye (security)	1:23.2.6+dfsg-1+deb11u4	vulnerable
	bookworm	1:25.2.3+dfsg-1+deb12u4	vulnerable
	bookworm (security)	1:25.2.3+dfsg-1+deb12u1	vulnerable
	trixie	1:27.3.4.1+dfsg-1+deb13u2	vulnerable
	forky, sid	1:29.0.2+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
erlang	source	(unstable)	1:29.0.2+dfsg-1			1139727

Notes

https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv
https://cna.erlef.org/cves/CVE-2026-48860.html
https://osv.dev/vulnerability/EEF-CVE-2026-48860
Fixed by: https://github.com/erlang/otp/commit/0209a6df65d605552b378273027b3968b35f26b4 (OTP-29.0.2, OTP-28.5.0.2, OTP-27.3.4.13)