CVE-2026-74994: 
Erlang OTP vulnerability analysis and mitigation

CVE-2026-74994 is an authorization bypass vulnerability in the mod_auth module of Erlang/OTP's inets httpd server, titled "Authentication Bypass via Directory Namespace Collapse in httpd mod_auth (dets/mnesia backends)." When the server is configured with dets or mnesia authentication backends and multiple directory configuration blocks, all directory blocks collapse into a single shared user/group namespace — meaning a user authorized for one protected directory is implicitly accepted as valid for all other protected directories on the same server instance. It affects OTP from 17.0 before 27.3.4.17, from 28.0 before 28.5.0.6, and from 29.0 before 29.0.6 (corresponding to inets versions 5.10–9.3.2.7, 9.4–9.6.2.3, and 9.7–9.7.2). The vulnerability was published on September 1, 2026, with a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 6.0 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause (CWE-863: Incorrect Authorization; CWE-1220: Insufficient Granularity of Access Control; CWE-1289: Improper Validation of Unsafe Equivalence in Input) lies in the mod_auth module's check_password/4 and secretp/2 functions, which passed DirData to the dets/mnesia backend without including the {path, Directory} key. As a result, all user/group records across different directory blocks shared a single per-listener namespace rather than being scoped per-directory. The fix injects {path, Directory} into DirData before any backend call, ensuring keys are properly scoped. Exploitation requires: (1) httpd configured with {auth_type, dets} or {auth_type, mnesia}, (2) two or more directory blocks with different require_user or require_group settings, and (3) valid credentials for at least one protected directory. Deployments using {auth_type, plain} or with only a single directory block are not affected (GitHub Advisory, OTP Commit).

Successful exploitation allows any authenticated user with valid credentials for one protected directory to access all other protected directories on the same inets httpd server instance, completely bypassing the intended per-directory authorization model. The impact is limited to confidentiality (high) — there is no integrity or availability impact, and the scope is unchanged. Depending on what sensitive data or functionality is hosted in the other protected directories, this could lead to unauthorized disclosure of confidential files, credentials, or application data (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.364%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable (GitHub Advisory).

1. Reconnaissance: Identify an Erlang/OTP inets httpd server instance running a vulnerable OTP version (17.0–27.3.4.16, 28.0–28.5.0.5, or 29.0–29.0.5) configured with {auth_type, dets} or {auth_type, mnesia} and multiple protected directory blocks with different user/group requirements.
2. Obtain credentials for one directory: Register or obtain valid credentials (username/password) for any one of the protected directories on the target server (e.g., /open with user one).
3. Attempt cross-directory access: Send an HTTP request with Basic Authentication credentials (obtained in step 2) targeting a different protected directory (e.g., /secret) that the attacker is not authorized to access.
4. Bypass authorization: Due to the namespace collapse bug, the server's mod_auth backend validates the credentials against the shared namespace and returns HTTP 200, granting access to the unintended directory and its contents.
5. Exfiltrate data: Browse or download files and resources from the unauthorized directory, which may include sensitive documents, credentials, or application data (GitHub Advisory, OTP Commit).

• Network: HTTP requests from a single authenticated user (or IP) successfully accessing multiple distinct protected directory paths on an inets httpd server (e.g., both /open/ and /secret/ returning HTTP 200 with the same credentials).
• Logs: inets httpd access logs showing HTTP 200 responses for a user authenticating against directories they were not explicitly added to; repeated successful authentication across multiple protected paths from the same user account.
• Application Behavior: mod_auth:get_user/4 returning a user record for a directory the user was never added to (observable via admin API calls or application-level logging).

Erlang/OTP has released patched versions: OTP 27.3.4.17 (inets 9.3.2.7), OTP 28.5.0.6 (inets 9.6.2.3), and OTP 29.0.6 (inets 9.7.2). Upgrading to one of these versions is the recommended remediation. If immediate upgrade is not possible, the following workarounds can be applied: (1) switch to the plain authentication backend ({auth_type, plain}), which correctly isolates per-directory namespaces; (2) ensure all protected directories use identical user populations, eliminating reliance on namespace isolation; or (3) place an authenticating reverse proxy in front of httpd to enforce per-directory access controls externally (GitHub Advisory, Microsoft MSRC).

The vulnerability was assigned and disclosed by the Erlang Ecosystem Foundation (EEF) as the CNA. Microsoft acknowledged the issue in its September 2026 Patch Tuesday update cycle, noting it affects the azl3_erlang package in Azure Linux 3. BleepingComputer covered the September 2026 Patch Tuesday release, which included this CVE among 966 flaws addressed (BleepingComputer). No significant independent researcher commentary or social media discussion has been identified beyond standard vulnerability aggregator coverage.