The inet_tls_dist:check_ip/1 function attempts to enforce a LAN allowlist for Erlang distribution over TLS, but mistakenly calls inet:sockname/1 instead of inet:peername/1 to obtain the connecting node’s IP address. Because inet:sockname/1 returns the local socket address, the local IP and the presumed peer IP are identical, so the subnet mask comparison always succeeds. The result is an unauthenticated bypass of the LAN restriction for any party presenting a CA‑signed TLS certificate, granting full distribution access—including rpc:call/4 and code:load_binary/3—which effectively enables remote code execution.

The vulnerability affects Erlang/OTP releases 26.0 through 28.5.0.2 and 27.3.4.13, up to but not including OTP 29.0.2. The corresponding SSL library versions are 11.0 up to before 11.7.2, 11.6.0.2, and 11.2.12.9. All installations of these OTP and SSL versions are susceptible.

The CVSS score of 7.5 classifies the vulnerability as high severity, and the EPSS score of < 1 % indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw over the network by presenting a valid CA‑signed TLS certificate configured for Erlang distribution; no additional privileges are required. The flaw permits unauthenticated bypass of the LAN allowlist, allowing full distribution access, including rpc:call/4 and code:load_binary/3, effectively enabling remote code execution.