Vulnerability · Published Jun 24, 2026 · Assigned by GitHub_M

CVE-2026-46348Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)

High 8.7

In plain English

A high-severity server-side request forgery in mastodon from mastodon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 65.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, the list of disallowed IP address ranges was lacking an IP address range that can be used to reach local IP addresses. An attacker can use an IP address in the affected range to make Mastodon perform HTTP requests against loopback interfaces, potentially allowing access to otherwise private resources and services. This vulnerability is fixed in 4.5.10, 4.4.17, and 4.3.23.

Affected products (as reported)

Vendor	Product	Versions
mastodon	mastodon	>= 4.5.0-beta.1, < 4.5.10

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/mastodon/mastodon/security/advisories/GHSA-crr4-7rm4-8gpw x_refsource_CONFIRM