PT-2026-21343 · Mastodon · Mastodon

Geeknik · Published 2026-02-20 · Updated 2026-03-02 · CVE-2026-27477

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.4.0 through 4.4.13 Mastodon versions 4.5.0 through 4.5.6

Description Mastodon is a free, open-source social network server based on ActivityPub. A flaw exists in FASP registration where an unauthenticated attacker can register a FASP with a chosen base url that points to a local or internal address. This can cause the Mastodon server to make requests to that address. This issue only impacts Mastodon servers with the experimental FASP feature enabled via the EXPERIMENTAL FEATURES environment variable, specifically when it includes fasp. An attacker can force the server to make http(s) requests to internal systems, potentially triggering vulnerabilities or undesired behavior in those systems. The attacker cannot control the complete URL or view the request results, but can influence the URL prefix.

Recommendations Mastodon version 4.4.14 or later Mastodon version 4.5.7 or later For administrators actively testing the experimental "fasp" feature, update your systems to the latest version. Servers not using the experimental feature flag fasp are not affected.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-MASTODON-2026-27477

CVE-2026-27477

GHSA-46W6-G98F-WXQM

Affected Products

Mastodon

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27477.json · Exploit
• https://github.com/mastodon/mastodon/security/advisories/GHSA-46w6-g98f-wxqm · Patch
• https://github.com/mastodon/mastodon/commit/7b85d2182361e68d51d9a02f94fb1070b5f503b1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27477 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27477 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mastodon-2026-27477 · Vendor Advisory
• https://twitter.com/CVEnew/status/2026676431460483348 · Twitter Post
• https://twitter.com/geeknik/status/2026412548279382433 · Twitter Post
• https://t.me/CVEtracker/45650 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026476386890793143 · Twitter Post
• https://twitter.com/geeknik/status/2024951110650274182 · Twitter Post