CVE-2026-488607.5HighCWE-1025

CVE-2026-48860: Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist

Erlang · OTP

Fixed in 11.2.12.9 · Affected: Erlang OTP before 11.2.12.9 · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.2%probability of exploitation in the next 30 days

11th percentile

050100

Higher than 11% of scored CVEs

7.5HighCVSS 4.0

LowMediumHighCrit.

DescriptionCVE.org

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2.

Affected products3

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Erlang · OTP26.0
Erlang · OTP11.0
Erlang · OTPVersions not stated

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Comparison Using Wrong Factors · Input Validation and Logic
Vendor: Erlang
Published: June 2026
Band: Unlikely (under 1%), June 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-48860 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.