PT-2026-2181 · Mastodon · Mastodon

Megamansec + 1 · Published 2026-01-08 · Updated 2026-01-13 · CVE-2026-22245

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.2.29, 4.3.17, 4.4.11, and 4.5.4

Description Mastodon is a social network server that makes outbound requests to user-provided domains. A protection mechanism exists to disallow requests to local IP addresses, intended to prevent a "confused deputy" problem. However, the list of disallowed IP address ranges was incomplete, allowing attackers to use specific IP addresses to make Mastodon perform HTTP requests against loopback or local network hosts. This could potentially allow access to private resources and services. The ALLOWED PRIVATE ADDRESSES variable is relevant to this issue.

Recommendations Update Mastodon to version 4.2.29. Update Mastodon to version 4.3.17. Update Mastodon to version 4.4.11. Update Mastodon to version 4.5.4.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-MASTODON-2026-22245

CVE-2026-22245

GHSA-XFRJ-C749-JXXQ

Affected Products

Mastodon

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22245.json · Exploit
• https://github.com/mastodon/mastodon/commit/0f4e8a6240b5af1f2c3f34d2793d8610c6ef2aca · Patch
• https://github.com/mastodon/mastodon/security/advisories/GHSA-xfrj-c749-jxxq · Vendor Advisory
• https://github.com/mastodon/mastodon/commit/17022907866710a72a1b1fc0a5ce9538bad1b4c3 · Patch
• https://github.com/mastodon/mastodon/commit/71ae4cf2cf5138ccdda64b1b1d665849b688686d · Patch
• https://osv.dev/vulnerability/CVE-2026-22245 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22245 · Security Note
• https://twitter.com/pulsepatchio/status/2011083429769629735 · Twitter Post
• https://t.me/CVEtracker/41734 · Telegram Post
• https://twitter.com/CVEnew/status/2009291487842820468 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009403376241451291 · Twitter Post