CVE-2026-74994: OTP inets httpd mod_auth directory namespace collapse

CVE-2026-74994 · Severity: info · CVSS 6 · Published 2026-09-01

OTP's inets httpd server contains an authentication bypass flaw in the mod_auth module when using dets or mnesia backends with multiple protected directories. Users authenticated for one directory are automatically accepted for all other protected directories on the same server, allowing unauthorized access to restricted content.

Technologies: Erlang Inets, Erlang OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-74994 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-74994 being exploited in the wild.
How severe is CVE-2026-74994?
Informational severity, with a CVSS score of 6, published 1 September 2026.
Which products and versions are affected?
Erlang Inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2; Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6.
Is there a fix for CVE-2026-74994?
A patch was published on 2026-09-01: Patches released in OTP 27.3.4.17, 28.5.0.6, 29.0.6 and corresponding inets versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74994 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-74994?
Check whether you run Erlang Inets or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The mod_auth module in OTP's inets httpd server improperly manages user/group namespaces when configured with dets or mnesia authentication backends and multiple directory configuration blocks. The vulnerability causes all directory blocks to collapse into a single shared namespace, rather than maintaining separate access control per directory. An authenticated user requires valid credentials for at least one protected directory (PR:L), but network access (AV:N) is required. An attacker with credentials for any protected directory gains unauthorized access to all protected directories on the same server instance. Patches are available in OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+, corresponding to inets 9.3.2.7, 9.6.2.3, and 9.7.2 respectively.

Affected products

  • Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
  • Erlang inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2

Timeline

  • 2026-09-01: disclosed
  • 2026-09-01: patched: Patches released in OTP 27.3.4.17, 28.5.0.6, 29.0.6 and corresponding inets versions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.