The inet_tls_dist:check_ip/1 function improperly uses inet:sockname/1 instead of inet:peername/1 to obtain the connecting node’s IP address. Since sockname returns the local socket address, the LAN allowlist comparison always succeeds, allowing any party that presents a CA‑signed TLS certificate to bypass the distribution‑over‑TLS LAN restriction. As a result, an attacker gains full distribution access to the node, including the ability to invoke rpc:call/4 and load code via code:load_binary/3, effectively achieving remote code execution.

This vulnerability impacts Erlang/OTP releases 26.0 through 29.0.2 (before 29.0.2), 27.3.4.13 (before 27.3.4.13), and 28.5.0.2 (before 28.5.0.2). Corresponding SSL module versions affected are 11.0 through 11.7.2 (before 11.7.2), 11.2.12.9 (before 11.2.12.9), and 11.6.0.2 (before 11.6.0.2). All installations of Erlang/OTP using these SSL versions are susceptible.

The CVSS score of 7.5 classifies the vulnerability as High severity, and the EPSS score of 0.00194 indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw over the network by presenting a valid CA‑signed TLS certificate configured for Erlang distribution; no additional privileges are required. Given the broad availability of certificate authorities and the fact that the mistake allows automatic bypass of the LAN allowlist, the potential impact is significant. Organizations should consider this a high‑risk issue pending patch deployment.