Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before 29.0.2, 28.5.0.2 and 27.3.4.13 corresponding to ssl from 11.0 before 11.7.2, 11.6.0.2 and 11.2.12.9.

An update of the erlang package has been released.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the d87e5fb4-64d4-11f1-ab11-4c526214c986 advisory.

    https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv reports:
    Erlang distribution over TLS run with the kernel check_ip               flag now properly enforces connecting nodes to be on the same               LAN. Previously the constraint was not enforced.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows     unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function,     which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of     inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address,     both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison     to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can     therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including     rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file     lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before 29.0.2, 28.5.0.2 and 27.3.4.13     corresponding to ssl from 11.0 before 11.7.2, 11.6.0.2 and 11.2.12.9. (CVE-2026-48860)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
323235	Photon OS 4.0: Erlang PHSA-2026-4.0-1038	Nessus	PhotonOS Local Security Checks	high
321790	Photon OS 5.0: Erlang PHSA-2026-5.0-0883	Nessus	PhotonOS Local Security Checks	high
320570	FreeBSD : Erlang/OTP -- TLS distribution check_ip flag does not enforce same-LAN constraint (d87e5fb4-64d4-11f1-ab11-4c526214c986)	Nessus	FreeBSD Local Security Checks	high
320500	Linux Distros Unpatched Vulnerability : CVE-2026-48860	Nessus	Misc.	high

Detections

Analytics

CVE-2026-48860

high

Tenable Plugins

high

high

high

high