Log in Start free

Vulnerability · Published Aug 10, 2026 · Assigned by GitHub_M

CVE-2026-72916Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses

Medium 6.3

In plain English

A medium-severity server-side request forgery in mastodon from mastodon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)1.0%top 37.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/lib/private_address_check.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. An attacker could supply an address in the omitted range to bypass the ALLOWED_PRIVATE_ADDRESSES protection and make Mastodon send HTTP requests to loopback interfaces, potentially accessing private resources and services. Exploitation requires a system that supports the obsolete IPv4-compatible IPv6 mechanism. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

Affected products (as reported)

VendorProductVersions
mastodon mastodon < 4.4.21>= 4.5.0-beta.1, < 4.5.14>= 4.6.0-beta.1, < 4.6.4

Weakness: CWE-918, CWE-1286 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

References