CVE-2026-25540: Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.3.19, 4.4.13, 4.5.6, Mastodon is vulnerable to web cache poisoning via Rails.cache. When AUTHORIZEDFETCH is enabled, the ActivityPub endpoints for pinned posts and featured hashtags have contents that depend on the account that signed the HTTP request. However, these contents are stored in an internal cache and reused with no regards to the signing actor. As a result, an empty response generated for a blocked user account may be served to requests from legitimate non-blocked actors, or conversely, content intended for non-blocked actors may be returned to blocked actors. This issue has been patched in versions 4.3.19, 4.4.13, 4.5.6.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25540?
CVE-2026-25540 is classified as a medium severity vulnerability due to its potential for web cache poisoning.
How do I fix CVE-2026-25540?
To fix CVE-2026-25540, upgrade to Mastodon versions 4.3.19, 4.4.13, or 4.5.6 or later.
What are the implications of CVE-2026-25540?
CVE-2026-25540 can lead to web cache poisoning, allowing attackers to deliver malicious content to users.
In which versions of Mastodon is CVE-2026-25540 found?
CVE-2026-25540 affects Mastodon versions prior to 4.3.19, 4.4.13, and 4.5.6.
What component of Mastodon does CVE-2026-25540 affect?
CVE-2026-25540 affects Mastodon's caching mechanism related to ActivityPub collection responses.