What is the CVSS score of CVE-2026-47389?

CVE-2026-47389 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Mastodon are affected by CVE-2026-47389?

Mastodon instances running versions before 4.5.10, 4.4.17, or 4.3.23 are vulnerable to a server-side request forgery that allows attackers with DNS control to bypass network isolation and access…. A patch is available.

How to fix or mitigate CVE-2026-47389?

Within 24 hours: Inventory all Mastodon instances and identify versions running before 4.5.10, 4.4.17, or 4.3.23. Within 7 days: Implement egress firewall rules to block outbound connections from Mastodon processes to private address ranges (192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12, 127.0.0.0/8, 169.254.0.0/16). Deploy DNS monitoring to detect suspicious internal hostname resolution. Within 30 days: Upgrade Mastodon to version 4.5.10, 4.4.17, or 4.3.23 or later (as specified in the description for each release branch); or as interim control, upgrade Ruby runtime to version 3.4+ on affected instances to block exploitation.

Mastodon CVE-2026-47389

EUVD-2026-39055 HIGH

Incomplete List of Disallowed Inputs (CWE-184)

2026-06-24 GitHub_M

Information Disclosure Mastodon

8.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Unauthenticated network-triggered outbound fetch (PR:N/UI:N/AV:N/AC:L) crosses a trust boundary to internal services (S:C) exposing data (C:H); no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 24, 2026 - 21:02 EUVD

Analysis Generated

Jun 24, 2026 - 20:20 vuln.today

DescriptionCVE.org

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, PrivateAddressCheck.private_address? returns false for IPv4-mapped IPv6 addresses (::ffff:a.b.c.d) corresponding to some private IPv4 addresses, depending on Ruby version, this can include loopback, RFC1918 private networks, and link-local space. An attacker who controls DNS for any domain can publish an AAAA record with such a mapped address; any outbound HTTP fetch Mastodon performs against that hostname then opens a real TCP connection to the underlying IPv4 address, including 127.0.0.1 and cloud-metadata endpoints such as 169.254.169.254. This vulnerability is fixed in 4.5.10, 4.4.17, and 4.3.23.

AnalysisAI

Server-side request forgery in Mastodon (versions before 4.5.10, 4.4.17, and 4.3.23) lets an attacker who controls authoritative DNS for a hostname bypass Mastodon's private-network filter and force the server to connect to internal IPv4 endpoints. The flaw stems from PrivateAddressCheck.private_address? …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Delivery

Publish AAAA record ::ffff:169.254.169.254

Exploit

Submit hostname URL to Mastodon

Execution

Server fetch bypasses private-address check

Persist

TCP connection to internal IPv4 endpoint

Impact

Exfiltrate metadata/credentials or internal data

Access

Delivery

Publish AAAA record ::ffff:169.254.169.254

Exploit

Submit hostname URL to Mastodon

Execution

Server fetch bypasses private-address check

Persist

TCP connection to internal IPv4 endpoint

Impact

Exfiltrate metadata/credentials or internal data

Vulnerability AssessmentAI

Exploitation	Exploitation requires (1) the target Mastodon instance to be running on a Ruby interpreter older than 3.4 - instances on Ruby 3.4+ are not affected; (2) the attacker to control authoritative DNS for a hostname and publish an AAAA record encoding an IPv4-mapped IPv6 address (::ffff:a.b.c.d) such as ::ffff:127.0.0.1 or ::ffff:169.254.169.254; and (3) a code path that causes Mastodon to perform an outbound HTTP fetch against that hostname (link preview, remote actor/object resolution, media or webfinger lookup). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) indicates network-reachable, low-complexity, unauthenticated exploitation with a scope change and high confidentiality impact - consistent with classic SSRF reaching a cloud-metadata service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers a domain, points an AAAA record at ::ffff:169.254.169.254, and gets a Mastodon instance to fetch a URL on that hostname (for example by submitting it as a link, remote profile, or object reference so the server generates a preview or resolves it). Because the private-address check passes the mapped address, the server opens a connection to the cloud metadata service and returns or processes the response, potentially leaking IAM credentials or internal service data. …
Remediation	Vendor-released patch: upgrade to Mastodon 4.5.10, 4.4.17, or 4.3.23 (whichever matches your branch), per advisory GHSA-xx55-4rrg-8xg6 (https://github.com/mastodon/mastodon/security/advisories/GHSA-xx55-4rrg-8xg6). … Detailed patch versions, workarounds, and compensating controls in full report.