CVE-2026-28808 Erlang CVE debrief

Who should care

Defenders and administrators of systems using Erlang OTP's inets modules should verify exposure and apply patches or mitigations to prevent unauthorized access to protected CGI scripts.

Why it matters

CVE-2026-28808 is a high-severity vulnerability in Erlang OTP's inets modules, allowing unauthenticated access to protected CGI scripts. Defenders should verify exposure, apply patches or mitigations, and review access controls to prevent exploitation.

• Verify exposure and apply patches or mitigations to prevent unauthorized access
• Review and update access controls for CGI scripts
• Monitor for potential exploitation attempts

Technical summary

The vulnerability occurs due to a path mismatch between mod_auth and mod_cgi in Erlang OTP's inets modules, allowing unauthenticated access to CGI scripts protected by directory rules. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. The issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. The vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations, as the vulnerability allows unauthorized access to protected CGI scripts.

Recommended defensive actions

• Verify exposure by checking OTP and inets versions
• Apply patches or mitigations from Erlang
• Review and update access controls for CGI scripts
• Monitor for potential exploitation attempts
• Perform a thorough review of system configurations and update documentation
• Consider implementing compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, while vendor advisories and patches are available from Erlang and other sources. Defenders should verify exposure by checking OTP and inets versions, review and update access controls for CGI scripts, and monitor for potential exploitation attempts. The vulnerability affects OTP from version 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from version 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, inets

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.