CVE-2026-27477: 
NixOS vulnerability analysis and mitigation

CVE-2026-27477 is a Server-Side Request Forgery (SSRF) vulnerability in Mastodon's experimental FASP (Federated Account Sign-up Protocol) feature. An unauthenticated attacker can register a FASP provider with an attacker-controlled base_url that resolves to a local or internal address, causing the Mastodon server to issue HTTP(S) requests to that address. Affected versions are 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6; the vulnerability only manifests when the EXPERIMENTAL_FEATURES environment variable includes fasp. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-918 (Server-Side Request Forgery): Mastodon's FASP request handler in app/lib/fasp/request.rb did not apply the custom Request::Socket class — which enforces private-address blocking — when making outbound HTTP requests to a registered FASP provider's base_url. This meant that a base_url pointing to an RFC-1918 or loopback address bypassed the existing SSRF protections used elsewhere in the codebase. The fix (commit 7b85d21) adds socket_class: ::Request::Socket to the FASP HTTP call and makes Request::Socket a public constant so it can be reused, and adds a test verifying that a hostname resolving to a private address raises Mastodon::ValidationError (GitHub Commit, GitHub Advisory). Exploitation requires no authentication, but the attacker can only influence the URL prefix (the base_url), not the full request path, and cannot read the server's response.

A successful exploit forces the Mastodon server to issue HTTP(S) requests to internal network addresses or localhost services that would otherwise be unreachable from the internet. While the attacker cannot read response bodies, they can probe internal network topology, trigger state-changing operations in unprotected internal services, or exploit vulnerabilities in those services (e.g., unauthenticated admin APIs, metadata endpoints). Confidentiality impact is rated None, but integrity impact is rated High due to the potential to trigger undesired behavior in backend systems (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the time of this report (Feedly). The EPSS score is approximately 0.05%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement that the target server has explicitly opted into the experimental fasp feature flag, significantly limiting the attack surface to a small subset of Mastodon deployments. The reporter credited in the GitHub advisory is geeknik (GitHub Advisory).

1. Reconnaissance: Identify Mastodon instances running versions 4.4.0–4.4.13 or 4.5.0–4.5.6 that have the EXPERIMENTAL_FEATURES=fasp environment variable set. This may be inferred from public instance metadata or version disclosure endpoints.
2. Craft malicious FASP registration request: Submit an unauthenticated FASP provider registration request to the target Mastodon server, supplying a base_url value that resolves to an internal address (e.g., http://169.254.169.254/ for cloud metadata, http://192.168.1.1/, or http://localhost:8080/).
3. Trigger server-side request: Upon processing the registration, the Mastodon server makes an outbound HTTP(S) request to the attacker-supplied base_url prefix without validating whether the resolved IP is private or loopback.
4. Probe or attack internal services: Repeat with different base_url values to enumerate open ports or services on the internal network, or to trigger undesired behavior (e.g., unauthenticated state changes) in internal APIs that trust requests from the Mastodon server's IP (GitHub Advisory, GitHub Commit).

• Logs: Mastodon application logs showing FASP provider registration attempts with base_url values containing RFC-1918 addresses (e.g., 10.x.x.x, 172.16–31.x.x, 192.168.x.x), loopback (127.0.0.1, ::1), or cloud metadata addresses (169.254.169.254).
• Network: Outbound HTTP(S) connections from the Mastodon server process to internal IP ranges or localhost ports that are not part of normal federated ActivityPub traffic.
• Logs: Repeated or automated FASP registration requests from the same source IP or with systematically varying base_url values, suggesting port/host enumeration.
• Application: Mastodon::ValidationError exceptions in logs related to FASP requests (present after patching; absence of these errors on a patched system with suspicious registrations may indicate pre-patch exploitation attempts).

Mastodon has released patched versions 4.4.14 (for the 4.4.x branch) and 4.5.7 (for the 4.5.x branch), both of which include the fix (GitHub Advisory, GitHub Commit). Administrators who are not actively testing the experimental FASP feature should ensure the fasp flag is absent from the EXPERIMENTAL_FEATURES environment variable — servers without this flag are entirely unaffected. If immediate patching is not possible, removing fasp from EXPERIMENTAL_FEATURES is an effective workaround. Additionally, network-level egress filtering to block the Mastodon server from reaching internal RFC-1918 ranges provides defense-in-depth.

The vulnerability was reported by security researcher geeknik, who is credited in the official GitHub Security Advisory (GitHub Advisory). Social media activity was limited, with brief mentions on Bluesky and a post by geeknik on X (via xcancel.com) shortly after disclosure. The advisory was rated "Low" severity by the Mastodon project itself, reflecting the narrow attack surface (experimental feature flag required). Coverage was primarily limited to automated vulnerability tracking services and CERT feeds such as INCIBE-CERT.