What is the CVSS score of CVE-2026-27477?

CVE-2026-27477 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mastodon are affected by CVE-2026-27477?

Organizations using versions 4.4.0 should be aware of moderate risk from CVE-2026-27477, a server-side request forgery vulnerability rated CVSS 5.9.. A patch is available.

How to fix or mitigate CVE-2026-27477?

Within 30 days: Identify affected systems running versions 4.4.0 and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Mastodon CVE-2026-27477

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-02-24 security-advisories@github.com

SSRF Mastodon

5.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Feb 26, 2026 - 21:17 nvd

Patch available

CVE Published

Feb 24, 2026 - 20:27 nvd

MEDIUM 5.9

DescriptionGitHub Advisory

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, an unauthenticated attacker can register a FASP with an attacker-chosen base_url that includes or resolves to a local / internal address, leading to the Mastodon server making requests to that address. This only affects Mastodon servers that have opted in to testing the experimental FASP feature by setting the environment variable EXPERIMENTAL_FEATURES to a value including fasp. An attacker can force the Mastodon server to make http(s) requests to internal systems. While they cannot control the full URL that is being requested (only the prefix) and cannot see the result of those requests, vulnerabilities or other undesired behavior could be triggered in those systems. The fix is included in the 4.4.14 and 4.5.7 releases. Admins that are actively testing the experimental "fasp" feature should update their systems. Servers not using the experimental feature flag fasp are not affected.

AnalysisAI

Mastodon servers with the experimental FASP feature enabled are vulnerable to Server-Side Request Forgery (SSRF) attacks, allowing unauthenticated attackers to register accounts with arbitrary base URLs that force the server to make requests to internal or local addresses. While attackers cannot control the full request path or view responses, this exposure of internal systems to external manipulation could facilitate reconnaissance or attacks on backend infrastructure. Affected versions are 4.4.0-4.4.13 and 4.5.0-4.5.6; a patch is available.

Technical ContextAI

Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects Mastodon. Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, an unauthenticated attacker can register a FASP with an attacker-chosen base_url that includes or resolves to a local / internal address, leading to the Mastodon server making requests to that address. This only affects Mastodon servers that have opted in to testing the experimental FASP feature by