Quick answers
- Is CVE-2026-48028 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48028 being exploited in the wild.
- How severe is CVE-2026-48028?
- Medium severity, with a CVSS score of 6.5, published 24 June 2026.
- Which products and versions are affected?
- Mastodon < 4.3.23, >= 4.4.0-beta.1 < 4.4.17, >= 4.5.0-beta.1 < 4.5.10.
- Is there a fix for CVE-2026-48028?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-48028 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-48028?
- Check whether you run Mastodon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in Mastodon's normalization process for incoming activities signed with Linked-Data Signatures (LDS). Due to improper validation of the integrity check value (CWE-354), an attacker who obtains a valid signed activity—for example, via ActivityPub inbox forwarding or a shared relay—can selectively remove JSON entries from the object. The Mastodon server will then recognize the modified object as a complete and validly signed activity. This allows for a specific class of spoofing where the integrity of the message is compromised without invalidating the cryptographic signature. The issue is resolved in versions 4.5.10, 4.4.17, and 4.3.23.
Affected products
- Mastodon Mastodon < 4.3.23, >= 4.4.0-beta.1 < 4.4.17, >= 4.5.0-beta.1 < 4.5.10
Timeline
- 2026-05-20: advisory: GitHub advisory published by Mastodon maintainers
- 2026-06-24: disclosed: CVE published to NVD