Read the docs
TI-2026-23002 Aliases CVE-2026-28808

ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

Priority MEDIUM 43CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl. This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00566 47th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ErlangOTP17.0 and later—No fix listedCNA
ErlangOTP5.10 and later—No fix listedCNA
  • OTP VendorErlang Affected 17.0 and later Fixed in — No fix listed CNA
  • OTP VendorErlang Affected 5.10 and later Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:erlang:erlang\/inets:*:*:*:*:*:*:*:*5.10 to before 9.1.0.6; after 9.2, before 9.3.2.4; after 9.4, before 9.6.2VulnerableErlang
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*17.0 to before 26.2.5.19; 27.0 to before 27.3.4.10; 28.0 to before 28.4.2VulnerableErlang
  • cpe:2.3:a:erlang:erlang\/inets:*:*:*:*:*:*:*:* Versions 5.10 to before 9.1.0.6; after 9.2, before 9.3.2.4; after 9.4, before 9.6.2 Vulnerable ·Erlang
  • cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* Versions 17.0 to before 26.2.5.19; 27.0 to before 27.3.4.10; 28.0 to before 28.4.2 Vulnerable ·Erlang

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28808
  2. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 3

Advisory 2

Other 2

  • TI-2026-36122 ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks CVSS 4.0MEDIUM 6.3
  • TI-2026-36121 httpc leaks Authorization header to cross-origin redirect targets CVSS 4.0HIGH 7.1
  • TI-2026-19284 Request smuggling via first-wins Content-Length parsing in inets httpd CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences