Mastodon EUVD-2026-39053

Exploitation requires Mastodon to be induced to fetch an attacker-controlled URL - i.e., it depends on Mastodon's outbound HTTP fetch behavior (link-preview/oEmbed generation, remote media retrieval, or ActivityPub actor/object resolution) being reachable by the attacker, and on the target host actually running services on its loopback interface that are worth reaching. The specific enabling defect is that the disallowed-IP-range list omitted a range that still routes to local IP addresses, so the attacker MUST supply an address within that gap range; ordinary loopback addresses already on the denylist will not work. The CVSS vector states PR:N/UI:N/AC:L (no authentication, no user interaction, low complexity), so against a default instance no special privileges are needed; however, real impact is LIMITED by what is bound to localhost on the server - an instance with no sensitive loopback-bound services yields little, and network egress filtering would block the request entirely. Verify the precise unauthenticated trigger path against the vendor advisory, as some Mastodon fetch flows are initiated by federated/registered actors.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:N/VI:H/VA:N, score 8.7 High) indicates a remotely reachable, low-complexity issue with no privileges or user interaction and a high integrity impact, while curiously rating confidentiality as none - a notable inconsistency given that SSRF to loopback is typically used to READ private resources, suggesting the VI:H/VC:N split may reflect the ability to drive state-changing requests against internal services rather than pure data exfiltration. No EPSS score, KEV listing, or POC was provided in the input, so real-world exploitation pressure cannot be quantified from available data; this is currently a patch-it-promptly issue based on severity and ease, not a confirmed in-the-wild emergency. SSRF impact is highly deployment-dependent: the real prize is whatever internal services (metadata endpoints, admin panels, databases, cache servers) are listening on the host's loopback - instances with sensitive localhost-bound services face materially higher risk. Note that PR:N implies unauthenticated triggering, but many Mastodon fetch paths are reached via posted content from a federated/registered actor; verify the exact unauthenticated trigger with the vendor advisory.

An attacker submits or federates content containing a crafted URL whose host resolves to an address in the previously-unfiltered range; when Mastodon fetches it for a link preview, media, or actor resolution, the request lands on the server's loopback interface. The attacker thereby probes or interacts with internal-only services (admin endpoints, caches, metadata services) that are firewalled off from the public internet. No public POC was identified, but the low attack complexity (AC:L) makes exploitation straightforward once the bypassing address range is known.