CVE-2026-28808 ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)
Attackers can bypass directory authentication to access protected CGI scripts in Erlang OTP inets when ScriptAlias is used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-28808?
CVE-2026-28808 is a high-severity missing authorization vulnerability in Erlang OTP, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.
When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.
This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.
This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Which versions are affected by CVE-2026-28808?
It affects 2 products.
Products include Erlang Erlang\/Inets, Erlang Erlang\/Otp.
How do I fix CVE-2026-28808?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-28808 being exploited?
There is no known exploitation of CVE-2026-28808 in the wild and no public exploit code.
Other vulnerabilities in Erlang OTP
Sources
Also known as AZL-83390, DEBIAN-CVE-2026-28808, EEF-CVE-2026-28808, GHSA-3vhp-h532-mc3f, OESA-2026-2572, OESA-2026-2573 and 1 more.