What is the CVSS score of CVE-2026-47389?

CVE-2026-47389 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Mastodon are affected by CVE-2026-47389?

Mastodon instances running versions before 4.5.10, 4.4.17, or 4.3.23 are vulnerable to a server-side request forgery that allows attackers with DNS control to bypass network isolation and access…. A patch is available.

How to fix or mitigate CVE-2026-47389?

Within 24 hours: Inventory all Mastodon instances and identify versions running before 4.5.10, 4.4.17, or 4.3.23. Within 7 days: Implement egress firewall rules to block outbound connections from Mastodon processes to private address ranges (192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12, 127.0.0.0/8, 169.254.0.0/16). Deploy DNS monitoring to detect suspicious internal hostname resolution. Within 30 days: Upgrade Mastodon to version 4.5.10, 4.4.17, or 4.3.23 or later (as specified in the description for each release branch); or as interim control, upgrade Ruby runtime to version 3.4+ on affected instances to block exploitation.

Mastodon CVE-2026-47389

EUVD-2026-39055 HIGH

Incomplete List of Disallowed Inputs (CWE-184)

2026-06-24 GitHub_M

Information Disclosure Mastodon

8.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Unauthenticated network-triggered outbound fetch (PR:N/UI:N/AV:N/AC:L) crosses a trust boundary to internal services (S:C) exposing data (C:H); no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 24, 2026 - 21:02 EUVD

Analysis Generated

Jun 24, 2026 - 20:20 vuln.today

DescriptionCVE.org

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, PrivateAddressCheck.private_address? returns false for IPv4-mapped IPv6 addresses (::ffff:a.b.c.d) corresponding to some private IPv4 addresses, depending on Ruby version, this can include loopback, RFC1918 private networks, and link-local space. An attacker who controls DNS for any domain can publish an AAAA record with such a mapped address; any outbound HTTP fetch Mastodon performs against that hostname then opens a real TCP connection to the underlying IPv4 address, including 127.0.0.1 and cloud-metadata endpoints such as 169.254.169.254. This vulnerability is fixed in 4.5.10, 4.4.17, and 4.3.23.

AnalysisAI

Server-side request forgery in Mastodon (versions before 4.5.10, 4.4.17, and 4.3.23) lets an attacker who controls authoritative DNS for a hostname bypass Mastodon's private-network filter and force the server to connect to internal IPv4 endpoints. The flaw stems from PrivateAddressCheck.private_address? returning false for IPv4-mapped IPv6 addresses (::ffff:a.b.c.d) on Ruby releases older than 3.4, so a malicious AAAA record can redirect any outbound fetch to loopback (127.0.0.1), RFC1918 hosts, or cloud-metadata services like 169.254.169.254. No public exploit identified at time of analysis, but the CVSS 8.6 (scope-changed, high confidentiality) rating reflects direct exposure of internal services and instance credentials.

Technical ContextAI

Mastodon is a Ruby on Rails ActivityPub federation server that performs many outbound HTTP fetches (link previews, remote actor/object resolution, media, webfinger) on behalf of users, making robust SSRF defenses essential. The PrivateAddressCheck helper is the safeguard intended to reject connections to private/internal address space before a socket is opened. The root cause is CWE-184 (Incomplete List of Disallowed Inputs): the check fails to canonicalize IPv4-mapped IPv6 addresses, where an IPv6 literal of the form ::ffff:a.b.c.d is semantically equivalent to the IPv4 address a.b.c.d. On Ruby versions older than 3.4 the address-parsing/private-range logic does not treat these mapped forms as their underlying IPv4 ranges, so private_address? returns false and the TCP connection proceeds to the real IPv4 destination. The CPE cpe:2.3:a:mastodon:mastodon covers all Mastodon installations on affected branches running a pre-3.4 Ruby interpreter.

RemediationAI

Vendor-released patch: upgrade to Mastodon 4.5.10, 4.4.17, or 4.3.23 (whichever matches your branch), per advisory GHSA-xx55-4rrg-8xg6 (https://github.com/mastodon/mastodon/security/advisories/GHSA-xx55-4rrg-8xg6). As an immediate compensating control where you cannot upgrade right away, upgrade the underlying Ruby runtime to 3.4 or newer, which eliminates the faulty mapped-address handling that triggers the bug. Additional defense-in-depth that reduces blast radius without replacing the patch: require IMDSv2 / disable or token-gate the cloud metadata endpoint (169.254.169.254) so SSRF cannot trivially harvest instance credentials, and apply egress firewall/network policy that blocks the Mastodon worker hosts from reaching loopback, RFC1918, and link-local ranges - note this egress filtering can break legitimate internal integrations and must be scoped to outbound fetch traffic. These controls limit impact but do not fully close the parsing flaw, so apply the version upgrade as the durable fix.