Is CVE-2026-73270 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73270 being exploited in the wild.

How severe is CVE-2026-73270?

Informational severity, with a CVSS score of 8.2, published 1 September 2026.

Which products and versions are affected?

Erlang Inets 5.10–9.3.2.6, 9.4–9.6.2.2, 9.7–9.7.1; Erlang OTP 17.0–27.3.4.16, 28.0–28.5.0.5, 29.0–29.0.5.

Is there a fix for CVE-2026-73270?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-73270 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-73270?

Check whether you run Erlang Inets or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73270: Erlang/OTP inets httpd auth bypass via case sensitivity

CVE-2026-73270 · Severity: info · CVSS 8.2 · Published 2026-09-01

Erlang/OTP's inets httpd module protects sensitive directories using mod_auth authentication, but this protection can be bypassed on case-insensitive filesystems (Windows, macOS) by requesting files with different path casing. An attacker can read protected files without authentication by simply changing the case of directory names in the URL, allowing unauthorized access to sensitive data protected by authentication rules.

Technologies: Erlang Inets, Erlang OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-73270 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73270 being exploited in the wild.
How severe is CVE-2026-73270?: Informational severity, with a CVSS score of 8.2, published 1 September 2026.
Which products and versions are affected?: Erlang Inets 5.10–9.3.2.6, 9.4–9.6.2.2, 9.7–9.7.1; Erlang OTP 17.0–27.3.4.16, 28.0–28.5.0.5, 29.0–29.0.5.
Is there a fix for CVE-2026-73270?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-73270 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-73270?: Check whether you run Erlang Inets or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an improper handling of case sensitivity vulnerability (CWE-178) in the mod_auth module of Erlang/OTP's inets httpd server. The vulnerability exists in mod_auth:secret_path/3, which uses re:run/3 to validate whether a request path falls within a protected directory block, but does not use the case-insensitive matching option. On case-insensitive filesystems, a request for /secret/file against a directory configured as /Secret will not match the regex pattern, bypassing authentication checks, while the filesystem itself resolves the mismatched casing to the same protected file and serves it. The attack requires network access to the httpd server and no authentication, but only succeeds on deployments using case-insensitive filesystems (default on Windows and macOS). Case-sensitive filesystems (Linux, Unix) are not affected because the filesystem itself rejects the mismatched path. Patches are available in OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+.

Affected products

Erlang OTP 17.0–27.3.4.16, 28.0–28.5.0.5, 29.0–29.0.5
Erlang inets 5.10–9.3.2.6, 9.4–9.6.2.2, 9.7–9.7.1

Timeline

2026-09-01: disclosed
2026-09-08: advisory: CNA advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.