CVE-2026-47389: 
Mastodon vulnerability analysis and mitigation

CVE-2026-47389 is a Server-Side Request Forgery (SSRF) vulnerability in Mastodon, a free, open-source social network server based on ActivityPub. It affects Mastodon versions up to and including 4.5.9, 4.4.16, 4.3.22, and all 4.2.x releases when running on Ruby versions older than 3.4. The vulnerability was published on June 24, 2026, and is described as an incomplete remediation for a prior SSRF issue (GHSA-xfrj-c749-jxxq). Fixed versions are 4.5.10, 4.4.17, and 4.3.23. It carries a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory).

The root cause is an incomplete blocklist in Mastodon's PrivateAddressCheck.private_address? method (CWE-184), which fails to correctly identify IPv4-mapped IPv6 addresses (e.g., ::ffff:a.b.c.d) as private when running on Ruby versions older than 3.4 (CWE-918). An attacker who controls DNS for any domain can publish an AAAA record resolving to such a mapped address; when Mastodon performs any outbound HTTP fetch against that hostname, it establishes a real TCP connection to the underlying private IPv4 address. Depending on the Ruby version, reachable targets include loopback (127.0.0.1), RFC1918 private networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local space, and cloud metadata endpoints such as 169.254.169.254 and 100.100.100.200. No authentication or user interaction is required to trigger the vulnerability (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to cause the Mastodon server to make arbitrary HTTP requests to internal network resources, with high confidentiality impact and a changed scope. Reachable targets include local services such as Sidekiq UI, internal admin endpoints, unauthenticated metrics/health endpoints, and database or Redis ports if HTTP-speaking. On cloud-hosted instances with IMDSv1 enabled (e.g., AWS EC2), an attacker could retrieve temporary IAM credentials from the metadata endpoint at 169.254.169.254, potentially enabling lateral movement into cloud infrastructure (GitHub Advisory).

1. Reconnaissance: Identify a publicly accessible Mastodon instance running Ruby < 3.4 (e.g., by checking the instance's /api/v1/instance endpoint or server headers for version information).
2. Set up malicious DNS: Register or control a domain and publish an AAAA DNS record resolving to an IPv4-mapped IPv6 address targeting an internal resource (e.g., ::ffff:7f00:0001 for 127.0.0.1, or ::ffff:a9fe:a9fe for 169.254.169.254).
3. Trigger outbound HTTP fetch: Cause the Mastodon instance to perform an outbound HTTP request to the attacker-controlled domain — for example, by submitting a post or profile with a link to the domain, or by federating content from an attacker-controlled ActivityPub server that references the domain.
4. Bypass SSRF protection: Because PrivateAddressCheck.private_address? returns false for the IPv4-mapped IPv6 address on Ruby < 3.4, Mastodon's SSRF filter is bypassed and the TCP connection is established to the underlying private IPv4 address.
5. Exfiltrate data: Retrieve the response from the internal endpoint — for example, cloud metadata credentials from 169.254.169.254/latest/meta-data/iam/security-credentials/ on IMDSv1-enabled EC2 instances — and use them for further access (GitHub Advisory).

• Network: Outbound HTTP requests from the Mastodon server to 169.254.169.254, 100.100.100.200, 127.0.0.1, or RFC1918 addresses (10.x.x.x, 172.16-31.x.x, 192.168.x.x) that are not expected in normal federation traffic.
• Network: DNS AAAA queries resolving to IPv4-mapped IPv6 addresses (e.g., ::ffff:a.b.c.d) for external domains, particularly those not associated with known Mastodon instances.
• Logs: Mastodon application logs showing outbound HTTP fetch attempts to unusual or internal hostnames; HTTP responses from internal services appearing in federation-related log entries.
• Logs: Cloud provider access logs (e.g., AWS CloudTrail) showing unexpected calls to the instance metadata service (169.254.169.254) originating from the Mastodon server process.
• Process/Application: Unexpected API calls or credential usage in cloud environments shortly after Mastodon federation activity, potentially indicating IAM credential theft via SSRF (GitHub Advisory).

Mastodon has released patched versions 4.5.10, 4.4.17, and 4.3.23 that address this vulnerability; upgrading to one of these versions is the primary recommended remediation (GitHub Advisory). As a secondary mitigation, upgrading the Ruby runtime to version 3.4 or later resolves the underlying address-check behavior that enables the bypass. For cloud-hosted instances, enabling IMDSv2 (requiring session-oriented requests) on AWS EC2 significantly reduces the risk of credential theft via the metadata endpoint. Operators unable to upgrade immediately should consider restricting outbound network access from the Mastodon server using firewall rules to block connections to link-local and private IP ranges.

The advisory credits three reporters — Revanth011, Vealending, and AlexMelanFromRingo — for discovering and disclosing the vulnerability (GitHub Advisory). The issue is explicitly noted as an incomplete remediation for a prior SSRF advisory (GHSA-xfrj-c749-jxxq), highlighting the difficulty of fully patching SSRF protections across diverse runtime environments. No significant broader media coverage or notable social media commentary has been identified at this time.