CVE-2026-46348 Details
Description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, the list of disallowed IP address ranges was lacking an IP address range that can be used to reach local IP addresses. An attacker can use an IP address in the affected range to make Mastodon perform HTTP requests against loopback interfaces, potentially allowing access to otherwise private resources and services. This vulnerability is fixed in 4.5.10, 4.4.17, and 4.3.23.
A server-side request forgery (SSRF) vulnerability has been identified in Mastodon versions prior to 4.5.10, 4.4.17, and 4.3.23. The issue arises because the list of disallowed IP address ranges did not include a range that could access local IP addresses. This oversight allows an attacker to use an IP address in the affected range to make Mastodon send HTTP requests to loopback interfaces, potentially accessing private resources and services.
Users can upgrade to Mastodon versions 4.5.10, 4.4.17, or 4.3.23 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mastodon/mastodon/security/advisories/GHSA-crr4-7rm4-8gpw | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mastodon | < 4.5.10 (semver) < 4.4.17 (semver) < 4.3.23 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |