CVE-2026-47389 Details
Description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, PrivateAddressCheck.private_address? returns false for IPv4-mapped IPv6 addresses (::ffff:a.b.c.d) corresponding to some private IPv4 addresses, depending on Ruby version, this can include loopback, RFC1918 private networks, and link-local space. An attacker who controls DNS for any domain can publish an AAAA record with such a mapped address; any outbound HTTP fetch Mastodon performs against that hostname then opens a real TCP connection to the underlying IPv4 address, including 127.0.0.1 and cloud-metadata endpoints such as 169.254.169.254. This vulnerability is fixed in 4.5.10, 4.4.17, and 4.3.23.
A server-side request forgery (SSRF) vulnerability has been identified in Mastodon versions 4.5.9 and prior, 4.4.16 and prior, 4.3.22 and prior, and all 4.2.x main versions. This issue arises when the application is running on Ruby versions older than 3.4. In these conditions, the method 'PrivateAddressCheck.private_address?' incorrectly evaluates IPv4-mapped IPv6 addresses as public, allowing an attacker to exploit this misclassification. By publishing a DNS AAAA record that maps to a private IPv4 address, an attacker can intercept outbound HTTP requests from the Mastodon server, potentially accessing local services, private network resources, or cloud metadata endpoints that could expose sensitive information, such as IAM credentials on AWS.
Users can upgrade to Mastodon versions 4.5.10, 4.4.17, or 4.3.23 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mastodon/mastodon/security/advisories/GHSA-xx55-4rrg-8xg6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-184 | Incomplete List of Disallowed Inputs | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mastodon | <= 4.5.9 (semver) <= 4.4.16 (semver) <= 4.3.22 (semver) <= 4.2.x ~main |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |