Skip to content
Fencer Vulns
medium 6.0

CVE-2026-74994 json

inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

published 2026-09-01 2 mo ago modified 2026-09-08 2 mo ago also EUVD-2026-69240

cvss
6.0
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all other protected directories on the same server instance.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Patch / fix

  • Erlang OTP 9.3.2.7, 9.6.2.3, 9.7.2, 27.3.4.17, 28.5.0.6, 29.0.6
  • erlang Debian 13 1:27.3.4.1+dfsg-1+deb13u4
  • erlang Debian 14 1:29.0.6+dfsg-1

debian advisories DEBIAN-CVE-2026-74994

  • erlang Ubuntu 22.04 LTS 1:24.2.1+dfsg-1ubuntu0.8
  • erlang Ubuntu 24.04 LTS 1:25.3.2.8+dfsg-1ubuntu4.8
  • erlang Ubuntu 26.04 LTS 1:27.3.4.6+dfsg-1ubuntu0.2
  • erlang Ubuntu Pro 14.04 LTS 1:16.b.3-dfsg-1ubuntu2.2+esm3
  • erlang Ubuntu Pro 16.04 LTS 1:18.3-dfsg-1ubuntu3.1+esm4
  • erlang Ubuntu Pro 18.04 LTS 1:20.2.2+dfsg-1ubuntu2+esm4
  • erlang Ubuntu Pro 20.04 LTS 1:22.2.7+dfsg-1ubuntu0.5+esm3

ubuntu advisories UBUNTU-CVE-2026-74994

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • erlang27 hummingbird 1 27.3.4.17-0.1.hum1
  • erlang27-et hummingbird 1 27.3.4.17-0.1.hum1
  • erlang27-wx hummingbird 1 27.3.4.17-0.1.hum1
  • erlang27-ftp hummingbird 1 27.3.4.17-0.1.hum1
  • erlang27-ssh hummingbird 1 27.3.4.17-0.1.hum1
  • erlang27-ssl hummingbird 1 27.3.4.17-0.1.hum1
  • erlang27-asn1 hummingbird 1 27.3.4.17-0.1.hum1
  • erlang27-edoc hummingbird 1 27.3.4.17-0.1.hum1

red hat advisories RHSA-2026:62531

  • erlang Azure Linux 3.0 26.2.5.21-6

azure linux advisories AZL-98496

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-74994 updated cvss 6.5

inets: otp: inets httpd mod_auth: Authentication Bypass via Directory Namespace Collapse

  • Red Hat Hardened Images erlang27 27.3.4.17-0.1.hum1
    fixed: vendor fix RHSA-2026:62531
  • Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/volsync-rhel9 Red Hat OpenShift Dev Spaces devspaces/traefik-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA 4.0 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Erlang OTP

Classification

Weakness
  • CWE-863 Incorrect Authorization
  • CWE-1289 Improper Validation of Unsafe Equivalence in Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.