CVE-2026-48860
Description
A flaw was found in Erlang/OTP. The inet_tls_dist:check_ip/1 function, responsible for enforcing a LAN allowlist for Erlang distribution over TLS, incorrectly uses inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. This allows an unauthenticated attacker, possessing a CA-signed TLS certificate, to bypass the LAN restriction. Consequently, the attacker can gain full Erlang distribution access to the node, enabling remote procedure calls and arbitrary code loading.
Mitigation
To mitigate this issue, restrict network access to the Erlang distribution port (default 4369) to only trusted hosts and networks using firewall rules. If Erlang distribution over TLS is not essential for your deployment, consider disabling it.
Example using `firewalld` to limit access to port 4369:
bashReplace `<TRUSTED_IP_OR_NETWORK>` with the specific IP address or network range that should be allowed to access the Erlang distribution. This may impact the functionality of services relying on Erlang distribution from untrusted networks.
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="4369" protocol="tcp" source address="<TRUSTED_IP_OR_NETWORK>" accept'
sudo firewall-cmd --reload
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | 6.5 | N/A |
| Attack Vector | Adjacent Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | High | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | High | None | N/A |
| Availability Impact | High | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
