CVE-2026-72916

UNKNOWN 0.0

Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/lib/private_address_check.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. An attacker could supply an address in the omitted range to bypass the ALLOWED_PRIVATE_ADDRESSES protection and make Mastodon send HTTP requests to loopback interfaces, potentially accessing private resources and services. Exploitation requires a system that supports the obsolete IPv4-compatible IPv6 mechanism. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

CWE	CWE-918 CWE-1286
Vendor	mastodon
Product	mastodon
Published	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for mastodon mastodon

Be the first to know when new unknown vulnerabilities affecting mastodon mastodon are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

mastodon / mastodon

< 4.4.21 >= 4.5.0-beta.1, < 4.5.14 >= 4.6.0-beta.1, < 4.6.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗