CVE-2026-74994: 
CBL Mariner Analyse et atténuation des vulnérabilités

CVE-2026-74994 is an authorization bypass vulnerability in the mod_auth module of Erlang/OTP's inets httpd server, caused by a directory namespace collapse when using dets or mnesia authentication backends. When multiple directory configuration blocks are defined, all user/group records collapse into a single shared namespace, allowing a user authenticated for one protected directory to access all other protected directories on the same server instance. It affects OTP 17.0 through 27.3.4.17, 28.0 through 28.5.0.6, and 29.0 through 29.0.6 (corresponding to inets 5.10–9.3.2.7, 9.4–9.6.2.3, and 9.7–9.7.2). The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.0 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-863 (Incorrect Authorization), CWE-1289 (Improper Validation of Unsafe Equivalence in Input), and CWE-1220 (Insufficient Granularity of Access Control). Specifically, the {path, Directory} tuple was never included in DirData when passed to the dets or mnesia auth backend modules, meaning all user/group lookup keys were scoped only to the listener rather than to the individual directory. As a result, the check_password/4 function in mod_auth.erl and the api_call path in mod_auth_server.erl both queried a shared namespace, making credentials valid for any protected directory on the same httpd instance. The fix injects {path, Directory} into DirData before backend calls in both the HTTP request authentication path (secretp/2) and the admin API path (GitHub Commit, GitHub Advisory). Exploitation requires: the server configured with {auth_type, dets} or {auth_type, mnesia}, two or more directory blocks with different require_user or require_group settings, and valid credentials for at least one protected directory.

Successful exploitation allows any authenticated user with valid credentials for one protected directory to access all other protected directories on the same inets httpd server instance, completely bypassing the intended per-directory authorization model. The primary impact is a high confidentiality loss — sensitive content restricted to specific user groups becomes accessible to unauthorized but authenticated users. There is no integrity or availability impact, and the vulnerability does not enable lateral movement beyond the affected httpd instance (GitHub Advisory, Red Hat).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Red Hat). The EPSS score is approximately 0.364%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable (per NVD SSVC assessment) as it requires an attacker to already possess valid credentials for at least one protected directory on the target server.

1. Reconnaissance: Identify an Erlang/OTP inets httpd server instance running a vulnerable OTP version (17.0–27.3.4.16, 28.0–28.5.0.5, or 29.0–29.0.5) configured with {auth_type, dets} or {auth_type, mnesia} and multiple protected directory blocks.
2. Obtain credentials: Acquire valid credentials for any one of the protected directories — for example, by registering as a legitimate user of a lower-privilege directory (e.g., /open).
3. Attempt cross-directory access: Send an HTTP request with Basic Authentication credentials (obtained in step 2) targeting a different protected directory (e.g., /secret) that the attacker should not have access to:

   GET /secret/ HTTP/1.1
   Host: target-server
   Authorization: Basic <base64(username:password)>

4. Observe bypass: Due to the namespace collapse, the server returns HTTP 200 instead of 401, granting access to the restricted directory's content.
5. Exfiltrate data: Browse or download content from the unauthorized directory, as the server treats the attacker's credentials as valid for all protected paths (GitHub Advisory, GitHub Commit).

• Network: HTTP requests from a single authenticated user accessing multiple distinct protected directories (e.g., /open/ and /secret/) in a short time window; HTTP 200 responses to requests for directories the user should not be authorized to access.
• Logs: inets httpd access logs showing successful (200 OK) authenticated requests to protected directories for users not explicitly listed in those directories' require_user or require_group configuration; repeated cross-directory access patterns from the same username or IP address.
• Application Behavior: Users appearing in mod_auth admin API queries (get_user) for directories they were never added to, returning results that should yield {error, no_such_user} on a patched system (GitHub Advisory).

Upgrade to a patched OTP release: OTP 27.3.4.17 (inets 9.3.2.7), OTP 28.5.0.6 (inets 9.6.2.3), or OTP 29.0.6 (inets 9.7.2) (GitHub Advisory). If immediate upgrade is not possible, the following workarounds are available:

• Switch to the plain authentication backend ({auth_type, plain}), which correctly isolates per-directory user/group namespaces.
• Ensure all protected directories use identical user populations, eliminating reliance on namespace isolation.
• Place an authenticating reverse proxy in front of the inets httpd server to enforce per-directory access controls externally.

Review httpd access logs to identify any unauthorized cross-directory access that may have occurred prior to patching.

The vulnerability was disclosed on September 1, 2026, via a GitHub Security Advisory published by the Erlang/OTP project. Microsoft acknowledged the issue in the context of their Azure Linux 3 (AZL3) Erlang packages and included it in the September 2026 Patch Tuesday cycle, which addressed 966 flaws (BleepingComputer). Red Hat also tracked the CVE and assigned it a Medium severity rating (Red Hat). No significant independent researcher commentary or broad community discussion has been observed beyond standard vulnerability tracking and aggregation.