CVE-2026-28808: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-28808 is an Incorrect Authorization vulnerability in the Erlang/OTP inets HTTP server (httpd) that allows unauthenticated attackers to access CGI scripts protected by directory-based access controls when script_alias is used. The flaw affects Erlang/OTP versions from 17.0 up to (but not including) 28.4.2, 27.3.4.10, and 26.2.5.19, corresponding to inets versions from 5.10 up to 9.6.2, 9.3.2.4, and 9.1.0.6. It was disclosed on April 7, 2026, and assigned a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an Incorrect Authorization flaw (CWE-863) combined with incorrect behavior order in authorization before path canonicalization (CWE-551). Specifically, the mod_alias module's which_alias/1 function only consulted alias entries and omitted script_alias entries when resolving request paths for authentication checks. As a result, mod_auth evaluated directory-based access controls against a DocumentRoot-relative path (which does not exist or is unprotected), while mod_cgi independently resolved and executed the script at the correct script_alias-mapped filesystem path — entirely bypassing authentication. The vulnerability resides in lib/inets/src/http_server/mod_alias.erl, mod_auth.erl, and mod_cgi.erl. The fix modifies which_alias/1 to include script_alias entries alongside alias entries, ensuring mod_auth evaluates rules against the actual filesystem path (GitHub Advisory, Patch Commit).

Successful exploitation allows unauthenticated remote attackers to invoke CGI scripts that were intended to be protected by mod_auth directory-based access controls, bypassing credential requirements entirely. The primary impact is high confidentiality exposure — attackers can read sensitive data returned by protected CGI scripts — along with a low integrity impact from the ability to trigger script execution without authorization. Availability is not directly impacted. Systems are only affected when script_alias maps a URL prefix to a directory outside DocumentRoot and mod_auth directory rules are configured to protect that external directory (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is network-exploitable with no authentication or user interaction required, though exploitation requires the specific server configuration (script_alias outside DocumentRoot with mod_auth protection). The EPSS score is approximately 0.049% (low probability of near-term exploitation). The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was responsibly disclosed by researcher imorgenstern to the Erlang/OTP project (GitHub Advisory).

1. Reconnaissance: Identify internet-facing services running the Erlang/OTP inets httpd server (OTP 17.0–28.4.1, 27.x before 27.3.4.10, or 26.x before 26.2.5.19) using banner grabbing or service fingerprinting tools.
2. Identify script_alias configuration: Probe for URL paths that correspond to script_alias mappings (e.g., /cgi-bin/, /scripts/) by sending HTTP GET requests and observing CGI-style responses (e.g., environment variable output, dynamic content).
3. Confirm authentication bypass: Send an unauthenticated HTTP GET request directly to a script_alias-mapped URL (e.g., GET /cgi-bin/protected-script.sh HTTP/1.1). On a vulnerable server, the request will succeed with HTTP 200 instead of returning HTTP 401, because mod_auth checks the wrong path and finds no applicable access controls.
4. Access protected CGI output: Retrieve the response body, which may contain sensitive environment variables, system information, or application data that the directory-based access controls were intended to restrict.
5. Escalate if possible: Depending on the CGI script's functionality, leverage unauthenticated access to trigger further actions such as data exfiltration, server-side operations, or reconnaissance for lateral movement (GitHub Advisory, Patch Commit).

• Network: Unexpected HTTP 200 responses to requests targeting script_alias-mapped URL paths (e.g., /cgi-bin/, /scripts/) from unauthenticated clients; absence of HTTP 401 responses for paths that should require authentication.
• Logs: HTTP access log entries showing successful (200 OK) requests to protected CGI script URLs without Authorization request headers; repeated access to CGI endpoints from unfamiliar source IPs.
• Process: CGI child processes spawned by the inets httpd server in response to unauthenticated requests; unexpected execution of scripts located in directories outside DocumentRoot.
• File System: Review mod_auth user/group files for unauthorized access patterns; check CGI script logs for execution events that do not correspond to authenticated sessions.

Upgrade to a patched version of Erlang/OTP: OTP 28.4.2, OTP 27.3.4.10, or OTP 26.2.5.19 (corresponding to inets 9.6.2, 9.3.2.4, or 9.1.0.6 respectively). If immediate patching is not possible, the following workarounds can mitigate the risk: (1) Move CGI scripts inside DocumentRoot and use alias instead of script_alias so mod_auth resolves the correct path; (2) Apply URL-based access controls at a reverse proxy layer to block unauthenticated access to script_alias URL prefixes; (3) Remove mod_cgi from the httpd modules chain if CGI functionality is not required. Additionally, audit server configurations to identify any script_alias mappings pointing outside DocumentRoot with mod_auth directory protections (GitHub Advisory, Patch Commit).

The vulnerability was announced alongside patch releases for all three supported OTP branches (28.4.2, 27.3.4.10, 26.2.5.19) on April 7, 2026, with release announcements posted to both the Erlang Forums and Elixir Forum communities (Erlang Forums OTP 28.4.2, Erlang Forums OTP 27.3.4.10). SUSE issued security updates for its Erlang packages addressing this CVE, and openSUSE security announcements were published across multiple update cycles (SUSE Advisory). Tenable released Nessus detection plugins (IDs 305625 and 310082) for the vulnerability. Community reaction was measured, reflecting the relatively narrow attack surface (specific script_alias + mod_auth configuration required).