Mastodon CVE-2026-46349

The target Mastodon instance must have ActivityPub federation enabled, which is the default and standard operating mode for all public-facing Mastodon servers - disabling federation renders the platform non-functional for its core use case. The attacker must possess or capture a valid Linked-Data Signed JSON-LD activity from a legitimate third-party actor; on the public fediverse, such activities are broadcast openly and are trivially collectable. No authentication to the target Mastodon instance is required (confirmed by PR:N in CVSS vector). Exploitation is limited to the integrity of activity processing - there is no confidentiality or availability impact. Exploitation does not affect Mastodon instances operating in fully isolated or allowlist-only federation modes, though such configurations are operationally atypical.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N yields a 5.3 Medium score, reflecting network-reachable, unauthenticated exploitation with low integrity impact and no confidentiality or availability consequence. No EPSS score was provided in the input, and no KEV listing confirms active exploitation. The tags reference 'JWT Attack' and 'Information Disclosure', though the description does not support a confidentiality breach - these tags may be misapplied or reflect a broader classification scheme rather than a literal data-leak. The real-world risk is primarily limited to the integrity of the federated activity graph: a successful exploit could cause a Mastodon server to process a spoofed activity (e.g., a falsely attributed post, follow, boost, or delete) as if it originated from a legitimate actor. For public-facing Mastodon instances participating in the fediverse, this is a meaningful trust integrity issue, though not catastrophic. The absence of a POC and KEV listing reduces urgency, but the low attack complexity (AC:L, PR:N) means exploitation is accessible once the technique is understood. Upgrade is the appropriate response; compensating controls are limited in the federation context.

An attacker operating or compromising any ActivityPub-compatible server obtains a legitimately signed JSON-LD activity (such as a public Note or Follow) from a real third-party actor - easily gathered from public fediverse traffic. The attacker re-arranges the JSON-LD structure in a way that preserves the cryptographic signature's validity under Mastodon's normalization logic but causes the activity to be interpreted with different semantic content or attribution. The crafted activity is submitted to the target Mastodon instance, which processes it as authentic, potentially crediting the spoofed action to the original signing actor.