CVE-2026-22245: 
NixOS vulnerability analysis and mitigation

CVE-2026-22245 is a Server-Side Request Forgery (SSRF) protection bypass vulnerability in Mastodon, a free, open-source ActivityPub-based social network server. The vulnerability stems from an incomplete list of disallowed IP address ranges in Mastodon's outbound request protection mechanism, allowing attackers to reach loopback and local network hosts. It affects all Mastodon versions prior to v4.2.29, v4.3.0–v4.3.16, v4.4.0–v4.4.10, and v4.5.0–v4.5.3. Disclosed on January 7–8, 2026, by researcher Joshua Rogers of Aisle Research, it carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-918 (Server-Side Request Forgery), specifically an incomplete IP address blocklist in Mastodon's PrivateAddressCheck module (app/lib/private_address_check.rb). The original CIDR_LIST did not include IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1), meaning an attacker could supply a user-controlled domain or URL that resolves to an IPv4-mapped IPv6 representation of a private or loopback address, bypassing the existing protections. The fix adds an IP4_CIDR_LIST and maps all IPv4 private ranges to their IPv6-mapped equivalents using .map(&:ipv4_mapped), ensuring both address families are covered (GitHub Advisory, Patch Commit). No authentication is required to trigger the outbound request, as Mastodon routinely fetches user-provided URLs as part of its federated ActivityPub operations.

Successful exploitation allows an unauthenticated remote attacker to cause the Mastodon server to issue HTTP requests to internal loopback addresses (e.g., 127.0.0.1) or local network hosts that are otherwise inaccessible from the internet. This can expose sensitive internal services such as admin panels, metadata endpoints (e.g., cloud instance metadata at 169.254.169.254), databases, or other infrastructure components co-located with the Mastodon instance. The primary impact is a high confidentiality risk — unauthorized access to private resources and data — with no direct integrity or availability impact (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires no authentication and no user interaction, making it trivially exploitable by any network-accessible attacker once a technique is known. The EPSS score is approximately 0.039% (very low probability of exploitation in the near term). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify a publicly accessible Mastodon instance running a vulnerable version (prior to v4.2.29, v4.3.17, v4.4.11, or v4.5.4) using tools like Shodan or Censys, searching for Mastodon server banners or known endpoints.
2. Identify SSRF entry point: Mastodon fetches user-provided URLs as part of ActivityPub federation (e.g., profile avatars, remote post previews, or link previews). Identify a feature that triggers an outbound HTTP request to an attacker-controlled or attacker-specified URL.
3. Craft bypass payload: Construct a URL or domain that resolves to an IPv4-mapped IPv6 address representing a private or loopback range not blocked by the original CIDR_LIST — for example, ::ffff:127.0.0.1 (loopback) or ::ffff:169.254.169.254 (cloud metadata). The original code did not map IPv4 private ranges to their IPv6 equivalents, so these addresses bypassed the blocklist.
4. Trigger the request: Submit the crafted URL through a Mastodon feature that causes the server to fetch it (e.g., by posting a link, following a remote account, or interacting with a federated resource pointing to the malicious URL).
5. Retrieve internal data: If the internal service responds, the response may be reflected back through Mastodon's processing pipeline or observable via timing/error differences, potentially exposing sensitive data such as cloud instance metadata, internal API responses, or service configuration (GitHub Advisory, Patch Commit).

• Network: Outbound HTTP requests from the Mastodon server to loopback addresses (127.0.0.1, ::1) or link-local addresses (169.254.x.x) originating from the Mastodon application process; unexpected connections to internal RFC 1918 ranges (10.x.x.x, 172.16.x.x, 192.168.x.x) from the Mastodon host.
• Logs: Mastodon application logs showing HTTP fetch attempts to IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) or unusual internal hostnames; repeated fetch errors or timeouts for requests targeting internal IP ranges.
• Network: DNS queries from the Mastodon server for domains that resolve to private or loopback IP addresses, particularly IPv4-mapped IPv6 representations.
• Application: Unusual ActivityPub federation activity involving remote actors or posts containing URLs pointing to private IP ranges or localhost addresses.

Mastodon has released patched versions addressing this vulnerability: v4.5.4, v4.4.11, v4.3.17, and v4.2.29. All affected instance operators should upgrade to the appropriate patched version immediately (GitHub Advisory). For deployments unable to patch immediately, administrators should implement firewall or network-level rules to block outbound connections from the Mastodon server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16) and their IPv6 equivalents. Additionally, review the ALLOWED_PRIVATE_ADDRESSES configuration to ensure only legitimately required private addresses are explicitly permitted (Feedly).

The vulnerability was discovered and reported by Joshua Rogers of Aisle Research, with credit also given to reporter 'shleeable' in the GitHub Security Advisory (GitHub Advisory). The advisory was published by Mastodon maintainer 'renchap' on January 7, 2026. Coverage appeared on security aggregators and community platforms including Bluesky, cvefeed.io, and VulnDB shortly after disclosure, indicating moderate community awareness. No major vendor statements or significant media controversy have been reported beyond the standard advisory and patch release.