CVE-2026-28808: Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scrip

This month

CRITICAL 9.8REMOTEUPGRADEUPGRADE

CVE-2026-28808 is a critical-severity flaw (CVSS 9.8) affecting erlang\/inets, erlang\/otp. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated acce

Why this priority

Critical severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.6% (top 54%)
CISA exploited list	No
Weakness	CWE-863, CWE-551
Published	2026-04-07
Last modified	2026-10-26

Publisher (CNA): EEF · Vendor: erlang

Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-04-07 13:16 UTCPublished CVE record published
2026-10-26 22:10 UTCUpdated Record last modified

erlang erlang\/inets UPGRADE

Affected: >= 5.10 and < 9.1.0.6 · > 9.2 and < 9.3.2.4 · > 9.4 and < 9.6.2

Fixed in: 9.1.0.6, 9.3.2.4, 9.6.2

Safe to downgrade to: a release before 5.10

1. Check installed version

apt-cache policy erlanginets || rpm -q erlanginets || erlanginets --version

2. UPGRADE to 9.1.0.6 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade erlanginets

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade erlanginets

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 5.10 (Debian / Ubuntu)

apt-cache madison erlanginets sudo apt install erlanginets=<VERSION_BEFORE_5.10> sudo apt-mark hold erlanginets

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list erlanginets sudo dnf downgrade erlanginets-<VERSION_BEFORE_5.10> sudo dnf versionlock add erlanginets

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

erlang erlang\/otp UPGRADE

Affected: >= 17.0 and < 26.2.5.19 · >= 27.0 and < 27.3.4.10 · >= 28.0 and < 28.4.2

Fixed in: 26.2.5.19, 27.3.4.10, 28.4.2

Safe to downgrade to: a release before 17.0

1. Check installed version

apt-cache policy erlangotp || rpm -q erlangotp || erlangotp --version

2. UPGRADE to 26.2.5.19 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade erlangotp

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade erlangotp

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 17.0 (Debian / Ubuntu)

apt-cache madison erlangotp sudo apt install erlangotp=<VERSION_BEFORE_17.0> sudo apt-mark hold erlangotp

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list erlangotp sudo dnf downgrade erlangotp-<VERSION_BEFORE_17.0> sudo dnf versionlock add erlangotp

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-28808?

erlang\/inets: upgrade to 9.1.0.6, 9.3.2.4, 9.6.2; erlang\/otp: upgrade to 26.2.5.19, 27.3.4.10, 28.4.2. Exact commands for each OS are on this page.

Is CVE-2026-28808 being exploited?

CVE-2026-28808 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-28808 affect?

CVE-2026-28808 affects erlang\/inets, erlang\/otp. Severity is critical (CVSS 9.8). Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside Document

How urgent is CVE-2026-28808?

Priority 51/100. Critical severity; Remotely exploitable, no login, no user action

Related CVEs

CVE-2026-48856 MEDIUM 6.5 UPGRADE UPGRADE Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sen
CVE-2026-48858 MEDIUM 6.5 UPGRADE UPGRADE Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce att

References

← Back to latest CVEs