PT-2026-2181 · Mastodon · Mastodon

Megamansec + 1 · Publicado 2026-01-08 · Atualizado 2026-01-13 · CVE-2026-22245

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.2.29, 4.3.17, 4.4.11, and 4.5.4

Description Mastodon is a social network server that makes outbound requests to user-provided domains. A protection mechanism exists to disallow requests to local IP addresses, intended to prevent a "confused deputy" problem. However, the list of disallowed IP address ranges was incomplete, allowing attackers to use specific IP addresses to make Mastodon perform HTTP requests against loopback or local network hosts. This could potentially allow access to private resources and services. The ALLOWED PRIVATE ADDRESSES variable is relevant to this issue.

Recommendations Update Mastodon to version 4.2.29. Update Mastodon to version 4.3.17. Update Mastodon to version 4.4.11. Update Mastodon to version 4.5.4.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BIT-MASTODON-2026-22245

CVE-2026-22245

GHSA-XFRJ-C749-JXXQ

Produtos afetados

Mastodon

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22245.json · Exploit
• https://github.com/mastodon/mastodon/commit/0f4e8a6240b5af1f2c3f34d2793d8610c6ef2aca · Correção
• https://github.com/mastodon/mastodon/security/advisories/GHSA-xfrj-c749-jxxq · Aviso do Fabricante
• https://github.com/mastodon/mastodon/commit/17022907866710a72a1b1fc0a5ce9538bad1b4c3 · Correção
• https://github.com/mastodon/mastodon/commit/71ae4cf2cf5138ccdda64b1b1d665849b688686d · Correção
• https://twitter.com/pulsepatchio/status/2011083429769629735 · Publicação no Twitter
• https://t.me/CVEtracker/41734 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-22245 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-22245 · Nota de Segurança
• https://twitter.com/CVEnew/status/2009291487842820468 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2009403376241451291 · Publicação no Twitter