CVE-2026-48028: 
Mastodon vulnerability analysis and mitigation

CVE-2026-48028 is a spoofing vulnerability in Mastodon, the open-source ActivityPub-based social network server, where insufficient normalization of incoming activities signed with Linked-Data Signatures allows attackers to remove JSON entries from valid signed activities originating from third-party actors. Published on June 24, 2026, it affects Mastodon versions prior to 4.3.23, 4.4.0-beta.1 through 4.4.17, and 4.5.0-beta.1 through 4.5.10. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is classified as CWE-354 (Improper Validation of Integrity Check Value), specifically in Mastodon's normalization process for incoming ActivityPub activities signed with Linked-Data Signatures. When Mastodon normalizes a signed activity, it does not adequately verify that all JSON entries are protected by the signature, enabling an attacker who possesses a valid signed activity to strip out specific JSON fields while the server still accepts the modified activity as legitimate. Exploitation requires the attacker to first obtain a copy of the original signed activity object — achievable through ActivityPub's inbox forwarding mechanism or via relay subscriptions — and then selectively remove JSON entries before forwarding the tampered activity to a target Mastodon server (GitHub Advisory).

Successful exploitation allows an attacker to selectively hide or remove content from signed ActivityPub activities, causing a Mastodon server to process an incomplete or manipulated activity as if it were the full, authentic original. This primarily affects integrity and availability — an attacker could suppress specific fields (e.g., content, recipients, or metadata) in federated activities, potentially disrupting federation behavior or misrepresenting the original author's intent. Confidentiality is not directly impacted, and the scope is limited to the affected Mastodon instance's federation processing (GitHub Advisory).

1. Obtain a signed activity: Control a Mastodon server or relay that receives forwarded ActivityPub activities from the target author, leveraging either ActivityPub inbox forwarding (where a recipient forwards the signed activity to the attacker's server) or a shared relay to which both the author and the attacker's server subscribe.
2. Extract the signed activity object: Capture the raw signed JSON-LD activity, including its Linked-Data Signature block, as delivered to the attacker-controlled server.
3. Selectively remove JSON entries: Identify JSON fields within the activity that are not fully protected by the Linked-Data Signature due to Mastodon's insufficient normalization, and remove those entries from the activity object.
4. Forward the tampered activity: Deliver the modified activity to the target Mastodon server via standard ActivityPub federation mechanisms.
5. Server accepts manipulated activity: The target Mastodon server validates the Linked-Data Signature (which still passes due to the normalization gap) and processes the incomplete activity as if it were the complete, authentic original (GitHub Advisory).

• Logs: Mastodon server logs showing incoming ActivityPub activities from unexpected or unfamiliar federated servers that are forwarding activities originally authored by third-party actors.
• Network: Unusual federation traffic patterns where a relay or remote server is forwarding signed activities to your instance that were not directly addressed to it.
• Application Behavior: Federated activities appearing with missing or incomplete fields (e.g., absent content, recipients, or metadata) that do not match what the original author published, potentially surfacing as incomplete posts or unexpected federation behavior.

Mastodon has released patched versions 4.5.10, 4.4.17, and 4.3.23 that address this vulnerability. Administrators should upgrade to one of these fixed versions as soon as possible. No configuration-based workarounds have been published; upgrading is the only recommended remediation (GitHub Advisory).

The vulnerability was reported by security researcher tesaguri and the advisory was published by Mastodon maintainer renchap on May 20, 2026, with the CVE assigned on June 24, 2026. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (GitHub Advisory).