Executive brief
Mastodon is an open-source social networking platform that communicates with other servers across the internet. A security flaw allowed the platform to be tricked into making requests to its own internal network or local services that should normally be private. This could allow an attacker to access sensitive internal data or interact with private administrative services that are not intended to be exposed to the public internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Mastodon due to an incomplete blocklist of private IP address ranges. Specifically, the validation logic failed to account for certain IPv6 address representations (such as the unspecified address '::') that can resolve to the local loopback interface. An unauthenticated remote attacker can provide a specially crafted URL that bypasses the 'ALLOWED_PRIVATE_ADDRESSES' filter. This allows the attacker to force the server to perform outbound HTTP requests to internal services or local interfaces. The issue is resolved in versions 4.5.10, 4.4.17, and 4.3.23 by updating the IP validation logic to include the missing ranges.
Affected products
- Mastodon Mastodon < 4.5.10, < 4.4.17, < 4.3.23
Timeline
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD