CVE-2026-48860: Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist

Synopsis

An authentication bypass vulnerability affects the inet_tls_dist module in Erlang/OTP, specifically the LAN allowlist enforcement used by Erlang's distribution-over-TLS mechanism. The bug stems from a sockname/peername confusion: check_ip/1 calls inet:sockname/1 (which returns the local socket address) instead of inet:peername/1 (the remote peer's address), so the subnet comparison always passes and any holder of a CA-signed TLS certificate can connect from outside the intended LAN segment without restriction. Successful exploitation grants full Erlang distribution access to the targeted node, enabling arbitrary remote code execution via rpc:call/4 and dynamic code loading via code:load_binary/3. A patched-image rebuild at the fixed commit (0209a6df65d605552b378273027b3968b35f26b4, corresponding to OTP 29.0.2, 28.5.0.2, and 27.3.4.13) is available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be positioned on an adjacent network (LAN, VPN, or similar Layer-2 segment) to reach the Erlang distribution port; broad internet exposure is not required, but the bug defeats the allowlist meant to restrict exactly this perimeter.

• AuthenticationRequired

  The attacker must present a certificate signed by a CA that the target node trusts; a low-privilege position in the PKI (possession of any such certificate) is sufficient to satisfy TLS handshake requirements and trigger the bypass.

• Victim interactionNot required

  No action by a user or administrator on the target node is needed; the attacker initiates the connection directly.

• Attack complexityDetail

  Exploitation requires a specific precondition: the attacker must hold a valid CA-signed TLS certificate for the affected cluster's PKI, and the node must have inet_tls_dist configured with an IP allowlist, making reliable exploitation contingent on those environmental factors.

Blast Radius

• Attacker gains full Erlang distribution node membership, allowing arbitrary Erlang function calls on the target node via rpc:call/4.
• Attacker can load arbitrary compiled Erlang modules into the running VM via code:load_binary/3, enabling persistent code execution under the OTP process.
• All data accessible to the Erlang node (in-memory state, ETS tables, Mnesia databases, secrets held in the process dictionary) is readable by the attacker.
• The attacker can crash or hang individual Erlang processes or the entire VM, causing a full service outage for any application running on that OTP node.