CVE-2026-73270: Erlang/OTP inets httpd Info Disclosure Flaw

CVE-2026-73270 Overview

CVE-2026-73270 is an authentication bypass vulnerability in the Erlang/OTP inetshttpd web server. The flaw resides in mod_auth:secret_path/3, which performs a case-sensitive regular expression check when deciding whether a resolved filesystem path falls inside a mod_auth protected directory. On case-insensitive filesystems, an attacker can request a protected resource using different casing to bypass the authentication challenge while mod_get still serves the file. The issue is classified as Improper Handling of Case Sensitivity [CWE-178].

Critical Impact
A remote unauthenticated attacker can read files inside a mod_auth protected directory on any Erlang/OTP httpd deployment running on a case-insensitive filesystem such as NTFS, HFS+, or default APFS.

Affected Products

Erlang/OTP 17.0 through versions before OTP 27.3.4.17 (inets 5.10 before 9.3.2.7)
Erlang/OTP 28.0 through versions before OTP 28.5.0.6 (inets 9.4 before 9.6.2.3)
Erlang/OTP 29.0 through versions before OTP 29.0.6 (inets 9.7 before 9.7.2)

Discovery Timeline

2026-09-01 - CVE-2026-73270 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-73270

Vulnerability Analysis

The Erlang/OTP inets HTTP server implements per-directory authentication through the mod_auth module. When a client requests a resource, mod_auth:secret_path/3 compares the resolved request path against configured protected directory blocks to decide whether an authentication challenge is required. This comparison relies on re:run/3 without the caseless option, making the check strictly case-sensitive.

The HTTP request handling pipeline and the underlying filesystem do not share this constraint on case-insensitive filesystems. An attacker requesting /secret/file against a directory configured as /Secret sidesteps the regex match, so mod_auth never issues the 401 challenge. The filesystem then resolves the differently cased path to the same file, and mod_get returns its contents to the unauthenticated caller.

Deployments on case-sensitive filesystems such as ext4 or XFS are not exploitable because the filesystem itself rejects the mismatched casing before mod_get can serve the resource.

Root Cause

The root cause is the case-sensitive regex evaluation inside mod_auth:secret_path/3. The authorization layer assumes canonical path casing that the request path handler does not enforce. When the filesystem accepts case variants, the mismatch between the authorization check and the file resolution creates the bypass condition.

Attack Vector

Exploitation requires only network access to the affected httpd endpoint. The attacker sends an HTTP request for a resource inside a mod_auth protected directory, altering the casing of the directory or filename component. No credentials, user interaction, or prior access are required.

text

// Security patch: canonicalize request path before mod_auth directory check
// lib/inets/src/http_server/httpd_request.erl
         {error, _, _} ->
             {error, {bad_request, {malformed_syntax, RequestURI}}};
         URI ->
-            {ok, URI}
+            {ok, collapse_uri_path_slashes(URI)}
+    end.
+
+%% Collapse consecutive slashes in the path component only.
+%% Uses uri_string:parse/1 to avoid mangling "://" in absolute URIs.
+collapse_uri_path_slashes([$/ | _] = Path) ->
+    %% Path-only form (the common case for httpd requests).
+    httpd_util:collapse_slashes(Path);
+collapse_uri_path_slashes(URI) ->
+    case uri_string:parse(URI) of
+        #{path := Path} = Parsed when map_size(Parsed) > 1 ->
+            uri_string:recompose(Parsed#{path => httpd_util:collapse_slashes(Path)});
+        _ ->
+            httpd_util:collapse_slashes(URI)
     end.

Source: GitHub OTP Commit 9641944

Detection Methods for CVE-2026-73270

Indicators of Compromise

HTTP 200 responses to requests targeting mod_auth protected paths without any preceding 401 challenge or Authorization header.
Access log entries showing successful GETs for the same resource with varied casing (for example /Secret/file and /secret/file) from the same client.
Requests that hit protected directories from source addresses that never authenticated during the session window.

Detection Strategies

Compare httpd access logs against mod_auth configuration and flag any 200 responses for URIs whose canonical form maps to a protected directory but whose request-line casing differs.
Alert on any request to a protected path where no WWW-Authenticate challenge was issued earlier in the same connection or client session.
Correlate request paths using case-insensitive normalization to identify probing patterns that iterate casing variants.

Monitoring Recommendations

Enable verbose httpd request logging and forward logs to a centralized analytics pipeline for path-normalization checks.
Baseline authentication challenge rates per protected directory and alert when the ratio of unchallenged requests rises.
Monitor for scanner signatures that mutate URL casing, especially against endpoints known to serve Erlang/OTP inetshttpd.

How to Mitigate CVE-2026-73270

Immediate Actions Required

Upgrade Erlang/OTP to 27.3.4.17, 28.5.0.6, or 29.0.6 depending on your release train.
Inventory all internal and internet-facing services that embed inetshttpd with mod_auth and prioritize those hosted on case-insensitive filesystems.
Review recent httpd access logs for requests to protected directories that were served without an authentication challenge.

Patch Information

The Erlang/OTP maintainers released fixes across three commits that canonicalize the request path before the mod_auth directory check and expose a new httpd_util:collapse_slashes/1 helper. See the GitHub Security Advisory GHSA-mh78-93cr-jx8f and the CNA advisory for CVE-2026-73270 for the full patch set, including commits 9641944, bac19eb3, and d8878dec.

Workarounds

Host inetshttpd deployments on case-sensitive filesystems such as ext4 or XFS, where the filesystem rejects mismatched casing before mod_get serves the file.
Place a reverse proxy in front of httpd that normalizes request paths to a canonical casing before forwarding to the Erlang backend.
Move sensitive content out of mod_auth protected directories until patched builds are deployed, or restrict access at the network layer.

bash

# Verify installed Erlang/OTP and inets versions
erl -eval 'io:format("OTP: ~s~ninets: ~s~n", [erlang:system_info(otp_release), element(3, lists:keyfind(inets, 1, application:loaded_applications()))]), halt().' -noshell

# Confirm the filesystem type hosting the httpd document root
df -T /path/to/httpd/docroot