Is CVE-2026-59825 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59825 being exploited in the wild.

How severe is CVE-2026-59825?

High severity, with a CVSS score of 7.4, published 18 August 2026.

Which products and versions are affected?

Mastodon prior to 4.4.19 and 4.5.0 to 4.5.12.

Is there a fix for CVE-2026-59825?

A patch was published on 2026-08-18: Fixed in versions 4.4.19 and 4.5.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59825 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-59825?

Check whether you run Mastodon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59825: Mastodon LDAP authentication global TLS verification bypass

CVE-2026-59825 · Severity: high · CVSS 7.4 · Published 2026-08-18

Mastodon, a popular open-source social network server, contains a configuration error in its LDAP authentication module that disables TLS certificate verification globally across all web server requests when LDAP_TLS_NO_VERIFY is enabled. This allows attackers performing man-in-the-middle attacks to intercept encrypted connections to external services without detection, compromising the confidentiality of sensitive data in transit.

Technologies: Mastodon. Vendors: Mastodon.

Quick answers

Is CVE-2026-59825 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59825 being exploited in the wild.
How severe is CVE-2026-59825?: High severity, with a CVSS score of 7.4, published 18 August 2026.
Which products and versions are affected?: Mastodon prior to 4.4.19 and 4.5.0 to 4.5.12.
Is there a fix for CVE-2026-59825?: A patch was published on 2026-08-18: Fixed in versions 4.4.19 and 4.5.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59825 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-59825?: Check whether you run Mastodon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in app/models/concerns/user/ldap_authenticable.rb, where LDAP authentication with LDAP_TLS_NO_VERIFY=true mutates the global OpenSSL::SSL::SSLContext::DEFAULT_PARAMS, disabling certificate verification for all subsequent TLS/SSL connections in puma web processes. This is a configuration validation issue: the code attempts to disable verification only for LDAP connections but inadvertently affects all outbound HTTPS requests from the web server. The vulnerability requires LDAP authentication to be configured and explicitly enabled via the LDAP_TLS_NO_VERIFY environment variable. An attacker with network position for MITM attacks can intercept connections to any external service called by Mastodon. The fix involves properly scoping certificate verification settings to only the LDAP context rather than mutating global OpenSSL defaults.

Affected products

Mastodon Mastodon prior to 4.4.19 and 4.5.0 to 4.5.12

Timeline

2026-08-18: disclosed
2026-08-18: patched: Fixed in versions 4.4.19 and 4.5.12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.