CVE-2026-55953: Fedora 44 Erlang SSL Client Authentication Bypass — Detection and Remediation Guide

Fedora has shipped an updated Erlang package for Fedora 44 addressing CVE-2026-55953, an authentication bypass vulnerability in the Erlang/OTP SSL client implementation (Fedora advisory). The fix is available through the standard dnf update channel.

This is not a niche concern. Erlang's ssl application underpins TLS connectivity for every Erlang and Elixir workload on the platform — and that includes some of the most security-critical software in enterprise environments: RabbitMQ brokers, CouchDB, EMQX MQTT brokers, ejabberd XMPP servers, Riak, and virtually every Phoenix/LiveView web application that initiates outbound HTTPS, database, or message-queue TLS connections. An authentication bypass in the SSL client means the trust decision your applications make about remote servers cannot be trusted — an attacker positioned to intercept or redirect traffic can potentially present credentials that the Erlang client would improperly accept.

If you run Fedora 44 nodes hosting Erlang/OTP workloads that connect outward over TLS, treat this as a priority patch. The vulnerability breaks the core security guarantee of TLS: verifying that the peer on the other end of the wire is who it claims to be.

Technical Analysis

Affected Products and Platforms

At the time of the advisory's publication, no CVSS vector was included in the distribution notice; the practical severity, however, is dictated by context. Any Erlang-based service that relies on TLS client authentication to protect backend connections — AMQPS to a message broker, LDAPS, MTS-STS, database TLS, inter-node Erlang distribution over TLS, or outbound HTTPS from Elixir apps via hackney/mint/finch — inherits the risk.

How the Vulnerability Works

In Erlang/OTP, TLS client authentication is performed inside the ssl application's certificate verification path (public_key validation chains, hostname verification via verify_fun, and handshake-state processing in ssl_handshake/tls_handshake). An authentication bypass class flaw in this code path typically manifests in one of three ways:

1. Improper certificate chain validation — a peer certificate that should fail validation (expired, wrong CA, revoked, self-signed where a CA was mandated) is accepted.
2. Hostname/identity verification failure — the client fails to bind the presented certificate to the intended peer identity (CN/SAN mismatch accepted), enabling impersonation by any holder of a valid-looking certificate.
3. Handshake state confusion — the client proceeds to encrypted application data before authentication is fully and correctly completed, allowing a manipulated handshake to slip past verification logic.

Regardless of the precise internal mechanism, the defensive consequence is identical: an attacker who can insert themselves between your Erlang client and its intended server — via DNS poisoning, ARP spoofing on a shared segment, rogue proxy, compromised upstream, or BGP/routing manipulation — can potentially impersonate the legitimate endpoint. The Erlang client will complete the "secure" connection and begin sending authentication credentials, queue payloads, session tokens, or customer data to the attacker.

Critically, this affects client-side verification — meaning even services that are otherwise locked down (no inbound exposure, hardened listeners) become vulnerable the moment they dial out. Egress traffic is now in scope.

Exploitation Status

At the time of writing, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation attributed to CVE-2026-55953, and it has not been added to the CISA Known Exploited Vulnerabilities catalog. However, SSL/TLS authentication bypass flaws are historically high-value targets for both nation-state actors (for covert interception and credential harvesting) and criminal operators (for token theft and lateral movement into backend services). Absence of observed exploitation is not a reason to defer — the attack surface is the trust anchor of every outbound TLS session your Erlang workloads initiate.

Detection & Response

Patching is the definitive fix, but you should also hunt for evidence that outbound TLS connections from Erlang/Elixir processes were intercepted or redirected — particularly connections terminating at unexpected IPs, on unexpected ports, or involving unusual certificate handling. The detections below focus on observable post-exploitation and MITM-indicator behavior rather than the vulnerability itself, which is not directly visible in telemetry.

Sigma Rules

---
title: Erlang BEAM Process Establishing Unusual Outbound TLS Connections
id: 3f8a2c14-7b5d-4e91-a6c2-9d4e5f6a7b8c
status: experimental
description: Detects the Erlang runtime (beam.smp) initiating outbound TLS connections to destinations or ports atypical for the host's role, which may indicate traffic redirection enabling exploitation of CVE-2026-55953 (SSL client authentication bypass).
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-erlang-2026-7a3db128e8
  - https://attack.mitre.org/techniques/T1557/
  - https://attack.mitre.org/techniques/T1071.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1557
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/beam.smp'
      - '/beam'
    DestinationPort:
      - 443
      - 5671
      - 636
      - 8883
      - 4369
      - 25672
  filter_known_destinations:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_known_destinations
falsepositives:
  - Legitimate Erlang/Elixir applications connecting to external SaaS APIs, brokers, or databases
  - Phoenix applications making outbound HTTPS calls
level: medium
---
title: Suspected TLS Interception Tooling Executed on Erlang Host
id: 6c1d9e42-2a3f-4b78-9c01-5e6f7a8b9c0d
status: experimental
description: Detects execution of common traffic interception and proxy tooling (mitmproxy, sslsplit, Ettercap, Bettercap, Responder, socat relay patterns) on hosts running Erlang workloads. Presence of such tooling outside a sanctioned penetration test may indicate active MITM positioning to exploit SSL client authentication bypass flaws such as CVE-2026-55953.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-erlang-2026-7a3db128e8
  - https://attack.mitre.org/techniques/T1557.002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1557.002
  - attack.t1040
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/mitmproxy'
      - '/mitmdump'
      - '/sslsplit'
      - '/ettercap'
      - '/bettercap'
      - '/responder'
      - '/Responder.py'
      - '/dsniff'
      - '/arpspoof'
  condition: selection
falsepositives:
  - Authorized red team or penetration testing engagements
  - Security research labs
level: high
---
title: ARP Spoofing or DNS Redirection Indicator on Linux Host
id: 9b4e7f31-8c2a-4d55-b3e6-1f2a3b4c5d6e
status: experimental
description: Detects modification of ARP tables or resolver configuration on Linux hosts, a common prerequisite for positioning a MITM attacker to intercept TLS client connections from Erlang/OTP workloads and abuse client-side authentication bypass flaws.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-erlang-2026-7a3db128e8
  - https://attack.mitre.org/techniques/T1557/
  - https://attack.mitre.org/techniques/T1071.004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1557
  - attack.defense_evasion
logsource:
  category: process_creation
  product: linux
detection:
  selection_arp:
    Image|endswith:
      - '/arpspoof'
      - '/arping'
    CommandLine|contains: '-t'
  selection_resolv:
    CommandLine|contains:
      - 'resolv.conf'
      - 'systemd-resolve --set-dns'
      - 'resolvectl dns'
  condition: selection_arp or selection_resolv
falsepositives:
  - Network administrators reconfiguring DNS resolvers
  - DHCP client updates to resolv.conf
level: medium

Tune the first rule against your environment's known external dependencies (your AMQPS brokers, databases, and API endpoints) by adding them to the filter. The second and third rules are low-noise in most production environments — interception tooling simply should not run on a production RabbitMQ or application host.

KQL — Microsoft Sentinel / Defender

Erlang hosts typically log into Sentinel via Syslog/CEF ingestion, and network telemetry arrives via CommonSecurityLog (firewalls, proxies) or Defender for Endpoint network events on onboarded Linux nodes. This query hunts for outbound TLS connections from BEAM processes and for certificate/interception anomalies reported by perimeter devices.

// Hunt: Erlang BEAM processes making outbound TLS connections to uncommon destinations,
// plus TLS anomalies from perimeter devices that may indicate MITM interception attempts
// targeting CVE-2026-55953 (Erlang SSL client authentication bypass).
let lookback = 7d;
let beam_conns =
    Syslog
    | where TimeGenerated > ago(lookback)
    | where ProcessName has_any ("beam", "beam.smp", "epmd")
    | where SyslogMessage has_any ("connect", "ssl", "tls", "handshake")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage;
let proxy_tls =
    CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where DestinationPort in (443, 5671, 636, 8883, 25672)
    | where DeviceAction =~ "alert" or Message has_any ("certificate", "self-signed", "unknown CA", "handshake failure", "TLS intercept")
    | summarize EventCount = count(), DistinctDests = dcount(DestinationIP) by SourceIP, DestinationHostName, DestinationPort, bin(TimeGenerated, 1h)
    | where DistinctDests > 5 or EventCount > 50;
union beam_conns, (proxy_tls | project TimeGenerated, Computer = SourceIP, ProcessName = "perimeter-tls", SyslogMessage = strcat("TLS anomaly: ", DestinationHostName, ":", DestinationPort))
| order by TimeGenerated desc;

If your Erlang nodes are onboarded to Defender for Endpoint, pivot on DeviceNetworkEvents filtering InitiatingProcessFileName == "beam.smp" joined against a threat-intel or known-broker allowlist to surface connections to infrastructure that has never previously been observed.

Velociraptor VQL

Use this hunt artifact across your Linux fleet to inventory Erlang/OTP installations, identify the running BEAM processes, and enumerate their active network connections — giving you a rapid picture of exposure and any suspicious outbound sessions.

-- Artifact: Linux.Hunt.ErlangSSLExposure
-- Purpose: Enumerate Erlang/OTP runtimes and their live network connections
-- to identify outbound TLS sessions potentially exposed to CVE-2026-55953
-- (SSL client authentication bypass) and confirm patch status.

LET beam_procs = SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ 'beam|epmd|erl'
   OR CommandLine =~ 'rabbitmq|ejabberd|emqx|elixir|mix '

LET conns = SELECT Pid, Name, Laddr, Raddr, Status, Type
FROM netstat()
WHERE Name =~ 'beam'
  AND Status =~ 'ESTAB'

LET pkg = SELECT * FROM execve(
    argv=['rpm', '-q', '--qf', '%{NAME}-%{VERSION}-%{RELEASE}\n', 'erlang', 'erlang-ssl'],
    length=100000)

SELECT * FROM beam_procs
UNION ALL
SELECT Pid, Name, format(format='%v -> %v (%v)', args=[Laddr, Raddr, Status]) AS CommandLine, '' AS Exe, '' AS Username
FROM conns

Follow this with a targeted rpm -V erlang-ssl verification step on flagged hosts to confirm the patched package is installed and its files are unmodified (see the remediation script below).

Remediation / Verification Script

The following Bash script inventories the installed Erlang packages, applies the Fedora update, verifies package integrity, identifies running BEAM processes that predate the patch (and therefore are still running vulnerable code in memory), and forces a controlled restart reminder.

#!/usr/bin/env bash
# CVE-2026-55953 - Fedora 44 Erlang SSL client authentication bypass remediation
# Run as root on Fedora 44 Erlang/OTP hosts

set -euo pipefail

echo "[*] Recording pre-patch Erlang package state..."
rpm -qa | grep -i '^erlang' | sort > /root/erlang-prepatch.txt
cat /root/erlang-prepatch.txt

echo "[*] Applying Fedora Erlang security update (FEDORA-2026-7a3db128e8)..."
dnf upgrade --refresh -y erlang\* || { echo "[!] dnf update failed"; exit 1; }

echo "[*] Verifying package integrity (no tampered files in erlang-ssl)..."
rpm -V erlang-ssl erlang-public_key || echo "[!] Integrity check flagged modified files - investigate"

echo "[*] Post-patch Erlang package state:"
rpm -qa | grep -i '^erlang' | sort > /root/erlang-postpatch.txt
diff /root/erlang-prepatch.txt /root/erlang-postpatch.txt || true

echo "[*] Checking for BEAM processes started BEFORE the patch (still running vulnerable code)..."
PKGTIME=$(rpm -q --qf '%{INSTALLTIME}\n' erlang-ssl 2>/dev/null | head -1 || echo 0)
ps -eo pid,lstart,etime,comm,args | awk '/beam/ && !/awk/'
FOUND=0
while read -r pid start_time _; do
  [[ "$pid" =~ ^[0-9]+$ ]] || continue
  if [[ -n "${PKGTIME}" && "${start_time}" -lt "${PKGTIME}" ]]; then
    echo "[!] PID ${pid} (beam) predates the patched package install - restart required"
    FOUND=1
  fi
done < <(ps -eo pid,lstart= -C beam.smp --no-headers 2>/dev/null | awk '{print $1, $2}')

if [[ "$FOUND" -eq 1 ]]; then
  echo "[!] ACTION REQUIRED: restart affected Erlang services, e.g.:"
  echo "    systemctl restart rabbitmq-server   # or your application service"
else
  echo "[+] No stale BEAM processes detected, or none running."
fi

echo "[*] Confirming needs-restarting state..."
dnf needs-restarting -r || true

echo "[+] Remediation complete. Review /root/erlang-postpatch.txt for the applied versions."

The critical operational detail: patching the package is not sufficient on its own. Erlang loads the ssl and public_key applications into the running VM at boot; any BEAM process started before the update continues executing the vulnerable code in memory until the service is restarted. Always restart affected services (rabbitmq-server, epmd-backed daemons, Phoenix releases, etc.) after applying the update.

Remediation

1. Patch immediately on all Fedora 44 Erlang hosts: sudo dnf upgrade --refresh erlang\* This pulls the corrected packages published under Fedora advisory FEDORA-2026-7a3db128e8.

2. Restart every Erlang/Elixir service. As noted above, the BEAM VM caches loaded applications. systemctl restart rabbitmq-server (or your equivalent), and confirm with dnf needs-restarting that no stale processes remain.

3. Inventory your outbound TLS dependencies. Enumerate every remote endpoint your Erlang clients authenticate to (brokers, databases, APIs, federation peers). Prioritize patching for hosts whose outbound sessions traverse untrusted or shared network segments — those carry the highest interception risk.

4. Enforce defense-in-depth on the network path:

   • Where feasible, pin or mutually authenticate high-value connections (mTLS with explicit CA pinning via a custom verify_fun) so that a verification-path flaw is not a single point of failure.
   • Restrict egress from Erlang hosts to known broker/database/API destinations via firewall policy — this both reduces exposure and makes the Sigma/KQL detections above dramatically quieter.
   • Deploy TLS-aware inspection or JA3/JA4 fingerprinting at egress points to detect interception anomalies.

5. Harden against MITM prerequisites: enable dynamic ARP inspection and DHCP snooping on segments hosting Erlang infrastructure, lock down resolver configuration, and monitor for unauthorized DNS changes.

6. Verify after patching: run rpm -V erlang-ssl erlang-public_key to confirm package integrity, and validate with erl -noshell -eval 'io:format("~s~n", [erlang:system_info(otp_release)]), halt().' that the expected OTP release is active.

7. Track upstream: monitor the Fedora advisory and the Erlang/OTP security announcements for any follow-on fixes or updated CVSS scoring, and watch the CISA KEV catalog for a change in exploitation status.

Final Assessment

CVE-2026-55953 is the kind of vulnerability that is easy to underestimate because it lives in a client library rather than an internet-facing listener. Don't. Authentication bypass in a TLS client silently converts your "encrypted and authenticated" backend connections into interception opportunities — and Erlang/OTP sits underneath message brokers and datastores that move some of the most sensitive payloads in the enterprise. Patch via dnf, restart your BEAM processes, hunt for interception indicators on affected segments, and treat egress from Erlang hosts with the same scrutiny you apply to ingress.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub