CVE-2026-48860: Fedora 43 Erlang Auth Bypass & DoS Flaws — Detection Guide

A critical security advisory for Fedora 43 has backported a set of high-severity fixes to the Erlang/OTP 26.x line, addressing multiple vulnerabilities that could lead to unauthorized cluster access, denial of service (DoS), and server-side request forgery (SSRF). The most severe of these, CVE-2026-48860, is an authentication bypass vulnerability in the dist-over-TLS component. Given Erlang's ubiquitous use in scalable telecommunications, messaging, and IoT infrastructure, this flaw represents a significant risk to distributed systems.

Defenders must treat this as an emergency patching cycle. Successful exploitation of the auth bypass allows an attacker to join a trusted Erlang cluster without credentials, potentially leading to data exfiltration, remote code execution (via cluster code loading), or total compromise of the distributed application. Concurrently, the DoS vulnerabilities (SCTP, SFTP, TLS 1.3) can be triggered remotely to crash critical VMs.

Technical Analysis

Affected Environment

• Platform: Fedora 43 (Rawhide/F45 fixes backported to OTP 26.x)
• Component: Erlang/OTP (Erlang RunTime System)

Vulnerability Breakdown

1. CVE-2026-48860 (Critical): dist-over-TLS Auth Bypass

   • Mechanism: A flaw in the ssl and dist handlers allows an attacker to bypass the authentication handshake when Erlang nodes connect over TLS. In a distributed Erlang setup, nodes authenticate via "cookies." This vulnerability likely allows a malicious node to skip this verification, effectively joining the cluster as a trusted peer.
   • Impact: Unauthorized access to inter-node communication, ability to execute arbitrary code on the cluster, or manipulate distributed state.

2. CVE-2026-48858: ftp SSRF (Server-Side Request Forgery)

   • Mechanism: The inets FTP client does not properly validate URLs or redirections.
   • Impact: An attacker can force the Erlang application to connect to arbitrary internal IP addresses and ports, scanning internal networks or interacting with unintended services (e.g., cloud metadata endpoints).

3. CVE-2026-49759: SCTP DoS

   • Mechanism: The SCTP (Stream Control Transmission Protocol) implementation in kernel app is susceptible to malformed packets.
   • Impact: Remote crash of the Erlang VM via SCTP protocol interaction.

4. CVE-2026-54886: ssh SFTP DoS

   • Mechanism: The SSH application's SFTP subsystem handling contains a flaw that triggers a resource exhaustion or panic.
   • Impact: Denial of Service for SSH/SFTP services running on the Erlang node.

5. CVE-2026-54891 & CVE-2026-55952: TLS Handshake Injection & Session Ticket DoS

   • Mechanism: Flaws in the ssl application regarding data injection during handshakes and handling of TLS 1.3 session tickets.
   • Impact: DoS conditions and potential protocol manipulation.

Exploitation Status

While these are newly disclosed CVEs for 2026, the upstream fix in OTP 27.x suggests the vulnerability logic is understood. The Auth Bypass (CVE-2026-48860) is trivial to weaponize against unpatched, internet-facing Erlang distribution ports.

Detection & Response

SIGMA Rules

The following rules detect potential exploitation attempts. Rule 1 monitors for the creation of Erlang crash dumps (indicative of DoS exploitation), and Rule 2 detects suspicious inbound connections to the Erlang Port Mapper Daemon (EPMD), which is a precursor to Auth Bypass attacks.

---
title: Potential Erlang DoS via Crash Dump Creation
id: 2c8f4d12-6a8e-4f9b-9b1c-2d3e4f5a6b7c
status: experimental
description: Detects the creation of erl_crash.dump files which indicate an Erlang VM crash, potentially due to CVE-2026-49759 or CVE-2026-54886 exploitation.
references:
 - https://linuxsecurity.com/advisories/fedora/fedora-43-erlang-2026-965be97ac0
author: Security Arsenal
date: 2026/09/23
tags:
 - attack.impact
 - attack.t1499
logsource:
 product: linux
 category: file_event
detection:
 selection:
 TargetFilename|endswith: '/erl_crash.dump'
 condition: selection
falsepositives:
 - Legitimate application errors and crashes during development
level: high
---
title: Suspicious Inbound Connection to EPMD (Erlang)
id: 9e1d2b3c-5f4a-4b6e-8c7d-1e2f3a4b5c6d
status: experimental
description: Detects inbound connections to port 4369 (EPMD) from external sources. Auth bypass CVE-2026-48860 requires interacting with EPMD to establish a distributed node connection.
references:
 - https://linuxsecurity.com/advisories/fedora/fedora-43-erlang-2026-965be97ac0
author: Security Arsenal
date: 2026/09/23
tags:
 - attack.initial_access
 - attack.t1190
logsource:
 product: linux
 category: network_connection
detection:
 selection:
 DestinationPort: 4369
 Initiated: 'false'
 filter:
 SourceIPAddress|startswith:
   - '127.'
   - '10.'
   - '192.168.'
   - '172.16.'
   - '172.17.'
   - '172.18.'
   - '172.19.'
   - '172.20.'
   - '172.21.'
   - '172.22.'
   - '172.23.'
   - '172.24.'
   - '172.25.'
   - '172.26.'
   - '172.27.'
   - '172.28.'
   - '172.29.'
   - '172.30.'
   - '172.31.'
 condition: selection and not filter
falsepositives:
 - Legitimate clustering from known internal subnets
level: medium

KQL (Microsoft Sentinel)

Assuming Linux Syslog or CEF data is ingested, this query looks for Erlang VM termination events or abnormal process exits associated with the DoS flaws.

Syslog
| where Facility in ('kern', 'daemon', 'user')
| where ProcessName contains "beam.smp" or SyslogMessage contains "erl_crash.dump"
| extend EventDetails = extract_all(@"(Killed|Segmentation fault|erl_crash.dump)", SyslogMessage)
| project TimeGenerated, HostName, ProcessName, SyslogMessage, EventDetails
| where isnotempty(EventDetails)

Velociraptor VQL

Hunt for active Erlang processes and their network listeners to identify exposure to the Auth Bypass vector.

-- Hunt for Erlang VM processes and open sockets on EPMD port
SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name =~ 'beam'

SELECT Fd, Family, Address, Port, Process.Pid, Process.Name
FROM netstat()
WHERE Port = 4369
   AND Process.Name =~ 'epmd'

Remediation Script (Bash)

This script checks for the presence of Erlang on Fedora and applies the necessary security update from the Fedora 43 repositories.

#!/bin/bash
# Remediation Script for Fedora 43 Erlang CVEs
# Checks for erlang installation and applies updates

 echo "Checking for Erlang installation..."

 if rpm -qa | grep -q erlang; then
   echo "Erlang detected. Applying security updates..."
   # Update the Erlang packages to the patched OTP 26.x version
   dnf update -y erlang*
   
   # Verify the update
   if [ $? -eq 0 ]; then
     echo "Update successful. Verifying versions..."
     rpm -qa | grep erlang
   else
     echo "Update failed. Please check repository connectivity."
     exit 1
   fi
 else
   echo "Erlang not installed on this system. No action required."
 fi

# Restart critical services (Example - uncomment and adjust for your environment)
# systemctl restart rabbitmq-server
# systemctl restart couchdb

Remediation

1. Immediate Patching: Update all Fedora 43 systems running Erlang/OTP immediately. Execute dnf update or ensure the specific erlang packages are updated to the version referenced in advisory 2026-965be97ac0.
2. Network Segmentation (Defense in Depth):
   • EPMD (Port 4369): Restrict inbound traffic to port 4369 strictly to known IP addresses of other cluster nodes. EPMD should never be exposed to the public internet or untrusted network segments.
   • Distribution Ports: Erlang uses a dynamic high port range for node communication. Ensure the inter-node communication range (configured via inet_dist_listen_min and inet_dist_listen_max) is firewalled similarly to EPMD.
3. Verify TLS Configuration: While the patch fixes CVE-2026-48860, ensure your dist configuration is explicitly set to require TLS and verifies peer certificates to prevent future misconfiguration-based bypasses.
4. Audit Logs: Review logs for unexpected Erlang VM crashes or connection attempts to EPMD from external IPs since the start of 2026.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub