Mastodon CVE-2026-47389

Exploitation requires (1) the target Mastodon instance to be running on a Ruby interpreter older than 3.4 - instances on Ruby 3.4+ are not affected; (2) the attacker to control authoritative DNS for a hostname and publish an AAAA record encoding an IPv4-mapped IPv6 address (::ffff:a.b.c.d) such as ::ffff:127.0.0.1 or ::ffff:169.254.169.254; and (3) a code path that causes Mastodon to perform an outbound HTTP fetch against that hostname (link preview, remote actor/object resolution, media or webfinger lookup). Per CVSS PR:N/UI:N this requires no authentication or user interaction on the Mastodon side, but the value of what is reachable depends on the deployment - a reachable, unauthenticated cloud-metadata endpoint or internal HTTP service is needed for meaningful impact, which limits exploitation against instances without such internal targets or with IMDSv2 enforced. The exact private ranges reachable vary by Ruby version, as noted in the description.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) indicates network-reachable, low-complexity, unauthenticated exploitation with a scope change and high confidentiality impact - consistent with classic SSRF reaching a cloud-metadata service. No EPSS score was provided and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation; it should be treated as no public exploit identified at time of analysis. The one limiting precondition not fully captured by AV:N/AC:L is the Ruby runtime: instances on Ruby 3.4 or newer are not affected, and the attacker must control DNS for a hostname Mastodon will fetch - a low bar (any attacker-owned domain) but still a prerequisite. Net assessment: a genuine high priority for self-hosted instances running older Ruby, especially those on cloud providers with unauthenticated metadata endpoints, but lower urgency for instances already on Ruby 3.4+. Exact affected version boundaries below 4.3.23 were not enumerated in the input and should be confirmed against the vendor advisory.

An attacker registers a domain, points an AAAA record at ::ffff:169.254.169.254, and gets a Mastodon instance to fetch a URL on that hostname (for example by submitting it as a link, remote profile, or object reference so the server generates a preview or resolves it). Because the private-address check passes the mapped address, the server opens a connection to the cloud metadata service and returns or processes the response, potentially leaking IAM credentials or internal service data. No public exploit identified at time of analysis, but the low attack complexity and unauthenticated network vector make weaponization straightforward.