Skip to main content

Mastodon EUVDEUVD-2026-55839

| CVE-2026-72916 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-08-10 security-advisories@github.com
SSRF
6.3
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

No authentication required (PR:N), network reachable (AV:N), high complexity from IPv4-compat prerequisite (AC:H), scope changes to internal systems (S:C); no direct availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 10, 2026 - 22:40 vuln.today
Analysis Generated
Aug 10, 2026 - 22:40 vuln.today
Patch available
Aug 10, 2026 - 22:20 EUVD

DescriptionCVE.org

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/lib/private_address_check.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. An attacker could supply an address in the omitted range to bypass the ALLOWED_PRIVATE_ADDRESSES protection and make Mastodon send HTTP requests to loopback interfaces, potentially accessing private resources and services. Exploitation requires a system that supports the obsolete IPv4-compatible IPv6 mechanism. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

AnalysisAI

SSRF protection bypass in Mastodon's IPv6 address normalization allows unauthenticated remote attackers to route application-layer HTTP requests to loopback interfaces and internal services by supplying IPv4-compatible IPv6 addresses (e.g., ::127.0.0.1) that the PrivateAddressCheck guard failed to recognize as private. All Mastodon instances prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 are affected; the flaw stems from a single missing branch in app/lib/private_address_check.rb that checked ipv4_mapped? …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft IPv4-compatible IPv6 loopback address
Delivery
Submit URL to Mastodon outbound fetch endpoint
Exploit
SSRF guard omits ipv4_compat? normalization
Execution
Address passes private-address check
Persist
Mastodon issues HTTP request to internal loopback service
Impact
Internal service returns sensitive data to attacker
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the operating system's networking stack processes IPv4-compatible IPv6 addresses in the obsolete ::x.x.x.x format (distinct from the modern ::ffff:x.x.x.x IPv4-mapped form); this is captured by the CVSS 4.0 AT:P metric and is non-default on most modern Linux kernels where this address class is deprecated. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.3 with vector AC:H/AT:P reflects that exploitation is meaningfully constrained: the target system must support the obsolete IPv4-compatible IPv6 mechanism, which is non-default on contemporary Linux and BSD platforms and is the primary limiting factor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker submits a crafted URL containing an IPv4-compatible IPv6 address such as ::127.0.0.1 (representing the loopback address) to a Mastodon endpoint that triggers outbound HTTP fetches, such as ActivityPub inbox processing or remote media fetch. Mastodon's SSRF guard evaluates the address as non-private because ipv4_compat? …
Remediation Operators should upgrade to Mastodon 4.4.21 (https://github.com/mastodon/mastodon/releases/tag/v4.4.21), 4.5.14 (https://github.com/mastodon/mastodon/releases/tag/v4.5.14), 4.6.4 (https://github.com/mastodon/mastodon/releases/tag/v4.6.4), or 4.7.0-beta.1 (https://github.com/mastodon/mastodon/releases/tag/v4.7.0-beta.1) depending on their active release track; vendor-released patched packages are available at those URLs. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Share

EUVD-2026-55839 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy