CVE-2026-25540: 
NixOS vulnerability analysis and mitigation

CVE-2026-25540 is a web cache poisoning vulnerability in Mastodon, the open-source ActivityPub-based social network server. When the AUTHORIZED_FETCH mode is enabled, the ActivityPub endpoints for pinned posts and featured hashtags cache responses without accounting for the identity of the signing actor, allowing cached content to be incorrectly served across different requestors. This affects Mastodon versions prior to 4.3.19, 4.4.13 (in the 4.4.x branch), and 4.5.6 (in the 4.5.x branch). It was published on February 4, 2026, with patches released simultaneously. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-524 (Use of Cache Containing Sensitive Information): Mastodon's Rails.cache stores ActivityPub responses for pinned posts and featured hashtags using cache keys that do not incorporate the identity of the HTTP request signer. When AUTHORIZED_FETCH is enabled, these endpoints are supposed to return different content depending on whether the requesting actor is blocked by the target user, but the cache is populated and reused without regard to the signing actor. An attacker (blocked actor) can exploit this by querying the endpoint within the 3-minute cache window after a legitimate actor has populated it, receiving content they should be denied; conversely, a blocked actor querying first can poison the cache with an empty response that is then served to legitimate users (GitHub Advisory). No authentication or user interaction is required to trigger the issue over the network.

Exploitation allows a blocked actor to access a target user's pinned posts and featured hashtags if they send a request within 3 minutes of a non-blocked actor's request, bypassing the intended access control enforced by AUTHORIZED_FETCH. Conversely, a blocked actor who queries the endpoint first can poison the cache, causing legitimate non-blocked users to receive empty responses — effectively a denial of service for that content. The impact is limited in scope to confidentiality (low) and availability (low), with no integrity impact, and is constrained to the specific ActivityPub collection endpoints (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.037%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target instance: Confirm the Mastodon instance has AUTHORIZED_FETCH enabled and is running a vulnerable version (< 4.3.19, < 4.4.13, or < 4.5.6).
2. Obtain a blocked account: Use or control an account that has been blocked by the target user on that instance.
3. Race the cache: As the blocked actor, send an HTTP GET request (signed with the blocked actor's key) to the target user's ActivityPub pinned posts or featured hashtags endpoint (e.g., /users/<username>/collections/featured or /users/<username>/collections/tags) before a legitimate actor does, or within 3 minutes after a legitimate actor has populated the cache.
4. Cache poisoning (denial of service path): If the blocked actor queries first, the empty response (generated because the actor is blocked) is stored in the cache. Subsequent requests from legitimate non-blocked actors within the cache TTL will receive this empty response.
5. Unauthorized content access path: If a legitimate actor has already populated the cache, the blocked actor's request within the cache window will receive the cached non-empty response, bypassing the block (GitHub Advisory).

• Logs: Repeated or timed HTTP GET requests to ActivityPub collection endpoints (e.g., /users/<username>/collections/featured, /users/<username>/collections/tags) from actor accounts that are blocked by the target user, particularly within short intervals.
• Network: Signed ActivityPub HTTP requests originating from known blocked remote actors or servers targeting pinned post/featured hashtag endpoints.
• Application Behavior: Legitimate users reporting empty pinned post or featured hashtag collections on a Mastodon instance running a vulnerable version with AUTHORIZED_FETCH enabled, which may indicate cache poisoning by a blocked actor.

Mastodon has released patched versions addressing this vulnerability: 4.3.19, 4.4.13, and 4.5.6. Administrators should upgrade to the appropriate patched version for their deployment branch as the primary remediation. No configuration-based workaround is documented; disabling AUTHORIZED_FETCH would remove the feature that triggers the vulnerable code path but would also remove the intended access control protections. After upgrading, administrators should review access logs to identify any potential unauthorized content access by blocked accounts during the vulnerable period (GitHub Advisory).

The advisory was published by Mastodon maintainer renchap on GitHub, crediting reporter odgrso for the discovery. Red Hat has tracked the CVE in their security database. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory, Red Hat CVE).