CVE-2026-22245: Mastodon has SSRF Protection bypass
Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow requests to local IP addresses (unless specified in ALLOWEDPRIVATEADDRESSES) to avoid the "confused deputy" problem. The list of disallowed IP address ranges was lacking some IP address ranges that can be used to reach local IP addresses. An attacker can use an IP address in the affected ranges to make Mastodon perform HTTP requests against loopback or local network hosts, potentially allowing access to otherwise private resources and services. This is fixed in Mastodon v4.5.4, v4.4.11, v4.3.17 and v4.2.29.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22245?
CVE-2026-22245 has a moderate severity level due to its potential impact on user-provided domains.
How do I fix CVE-2026-22245?
To fix CVE-2026-22245, ensure that Mastodon is updated to a version higher than 4.5.4 or implement additional access controls for outbound requests.
What software versions are affected by CVE-2026-22245?
CVE-2026-22245 affects Mastodon versions from 4.2.29 up to 4.5.4.
What kind of vulnerability is CVE-2026-22245?
CVE-2026-22245 is a security vulnerability related to improper handling of outbound requests in Mastodon.
Can I safely use Mastodon if I'm on a version affected by CVE-2026-22245?
Using an affected version of Mastodon poses a risk, so it is recommended to either patch the version or upgrade to mitigate this vulnerability.