CVE-2026-59825

HIGH 7.4

Mastodon: Unwanted deactivation of SSL/TLS certificate verification

CVSS Score

7.4

EPSS Score

0.0%

EPSS Percentile

0th

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq background jobs remain unaffected. This issue is fixed in versions 4.4.19 and 4.5.12.

CWE	CWE-295
Vendor	mastodon
Product	mastodon
Published	Aug 18, 2026
Last Updated	Aug 18, 2026

Stay Ahead of the Next One

Get instant alerts for mastodon mastodon

Be the first to know when new high vulnerabilities affecting mastodon mastodon are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

mastodon / mastodon

< 4.4.19 >= 4.5.0, < 4.5.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/mastodon/mastodon/security/advisories/GHSA-3rhr-8phh-jm86 github.com: https://github.com/mastodon/mastodon/pull/39571 github.com: https://github.com/mastodon/mastodon/commit/2ccb6ef277e725d1932295690cf8ab9d3dc03149 github.com: https://github.com/mastodon/mastodon/commit/5748d0b16ea09001e0933f76c7afe814e09652ef github.com: https://github.com/mastodon/mastodon/commit/761c61b42590a2fd91442fc15a0a7583e48bbea4 github.com: https://github.com/mastodon/mastodon/releases/tag/v4.4.19 github.com: https://github.com/mastodon/mastodon/releases/tag/v4.5.12