Auth bypass in Erlang Erlang\/inets
CVE-2026-28808
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (53.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 53.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.008 · change: +0.002
Affected products
- Erlang Erlang\/inets
- Erlang Erlang\/otp
- Erlang Otp — versions 5.10, 17.0, 07b8f441ca711f9812fad9e9115bab3c3aa92f79
Weakness classification (CWE)
References
- GitHub Advisory (related, vendor-advisory, Third Party Advisory)
- EEF CNA record for CVE-2026-28808 (related, Mitigation, Vendor Advisory)
- OSV record EEF-CVE-2026-28808 (related, Patch, Third Party Advisory)
- Erlang/OTP version ordering (Product, x_version-scheme)
- Fix commit 8fc71ac in erlang/otp (Patch, patch)
- Fix commit 9dfa0c5 in erlang/otp (Patch, patch)
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- Introducing commit 07b8f44 in erlang/otp (related)
Frequently asked questions
- What is CVE-2026-28808?
- CVE-2026-28808 is a critical-severity vulnerability in Erlang Erlang\/inets, classified under Incorrect Authorization. CVSS score: 9.8/10. Published 2026-04-07.
- How severe is CVE-2026-28808?
- Critical severity. CVSS v3 base score is 9.8 out of 10.