Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 28.4.2, OTP 27.3.4.10 and OTP 26.2.5.19, corresponding to inets from 5.10 before 9.6.2, 9.3.2.4 and 9.1.0.6.

An update of the erlang package has been released.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1714-1 advisory.

    - CVE-2026-21620: remote arbitrary read/write via TFTP relative path traversal (bsc#1258663).
    - CVE-2026-23941: HTTP Request Smuggling in Erlang OTP (bsc#1259687).
    - CVE-2026-23942: path traversal vulnerability in Erlang OTP (bsc#1259681).
    - CVE-2026-23943: denial of service due to improper handling of highly compressed data in Erlang OTP ssh     (bsc#1259682).
    - CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts     (bsc#1261728).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2a93359b0b advisory.

    Erlang ver. 26.2.5.19


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20607-1 advisory.

    Security issues fixed:

    - CVE-2026-21620: improper isolation and compartmentalization can lead to TFTP relative path traversal and     remote       arbitrary reads/writes (bsc#1258663).
    - CVE-2026-23941: improper handling of duplicate Content-Length headers in Erlang OTP can lead to HTTP     request       smuggling (bsc#1259687).
    - CVE-2026-23942: improper limitation of a pathname to a restricted directory in the SFTP server can lead     to path       traversal (bsc#1259681).
    - CVE-2026-23943: improper handling of highly compressed data in Erlang OTP ssh can lead to denial of     service       (bsc#1259682).
    - CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts     (bsc#1261728).
    - CVE-2026-28810: predictable DNS transaction IDs can lead to DNS cache poisoning (bsc#1261726).
    - CVE-2026-32144: missing signature verification can lead to OCSP authorization bypass and information     disclosure       (bsc#1261734).

    Other updates and bugfixes:

    - jinterface: allow to build determenistic OtpErlang.jar (bsc#1262288).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dd4a7e240e advisory.

    Erlang ver. 26.2.5.19


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-53a7ddccc8 advisory.

    Erlang ver. 26.2.5.19


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI     scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to     a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the     DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path     mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This     vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl,     lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP     from OTP 17.0 before OTP 28.4.2, OTP 27.3.4.10 and OTP 26.2.5.19, corresponding to inets from 5.10 before     9.6.2, 9.3.2.4 and 9.1.0.6. (CVE-2026-28808)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
332282	Photon OS 5.0: Erlang PHSA-2026-5.0-91-0831	Nessus	PhotonOS Local Security Checks	Local	high
313669	SUSE SLES15 Security Update : erlang (SUSE-SU-2026:1714-1)	Nessus	SuSE Local Security Checks	Local	high
312353	Photon OS 5.0: Erlang PHSA-2026-5.0-0831	Nessus	PhotonOS Local Security Checks	Local	high
312351	Photon OS 4.0: Erlang PHSA-2026-4.0-1005	Nessus	PhotonOS Local Security Checks	Local	high
310543	Fedora 44 : erlang (2026-2a93359b0b)	Nessus	Fedora Local Security Checks	Local	high
310082	openSUSE 16 Security Update : erlang (openSUSE-SU-2026:20607-1)	Nessus	SuSE Local Security Checks	Local	high
306617	Fedora 42 : erlang (2026-dd4a7e240e)	Nessus	Fedora Local Security Checks	Local	high
306606	Fedora 43 : erlang (2026-53a7ddccc8)	Nessus	Fedora Local Security Checks	Local	high
305625	Linux Distros Unpatched Vulnerability : CVE-2026-28808	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-28808

high

Tenable Plugins

high

high

high

high

high

high

high

high

high