CVE-2026-72916

Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses

State: Published
Severity: 6.3 Medium
Published: Aug 10, 2026
Updated: Aug 13, 2026
Reserved: Aug 10, 2026

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/lib/private_address_check.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. An attacker could supply an address in the omitted range to bypass the ALLOWED_PRIVATE_ADDRESSES protection and make Mastodon send HTTP requests to loopback interfaces, potentially accessing private resources and services. Exploitation requires a system that supports the obsolete IPv4-compatible IPv6 mechanism. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L	GitHub_M

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)
CWE-1286 Improper Validation of Syntactic Correctness of Input

Affected Products

Product	Versions
mastodonmastodon	< 4.4.21Affected >= 4.5.0-beta.1, < 4.5.14Affected >= 4.6.0-beta.1, < 4.6.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.