CVE-2026-59825: Mastodon: Unwanted deactivation of SSL/TLS certificate verification
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq background jobs remain unaffected. This issue is fixed in versions 4.4.19 and 4.5.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mastodonto a version that resolves this vulnerability.Fixed in 4.4.19 - Upgrade
Upgrade
Mastodonto a version that resolves this vulnerability.Fixed in 4.5.12
Event History
Frequently Asked Questions
Which deployments and processes are affected?
Mastodon deployments using LDAP authentication with LDAP_TLS_NO_VERIFY=true are exposed. The global change affects outbound requests made by Puma web processes; Sidekiq background jobs remain unaffected.
What would an attacker need to exploit this issue?
An attacker would need to exploit the absence of TLS certificate verification on requests made by affected Puma processes, such as by presenting an untrusted or forged certificate to an outbound connection. The issue is remotely reachable, requires no privileges or user interaction, but has high attack complexity.
What mitigation is available if patching cannot happen immediately?
Upgrade to Mastodon 4.4.19 or 4.5.12. If upgrading is not immediately possible, avoid configuring LDAP_TLS_NO_VERIFY=true, because that setting triggers the global disabling of certificate verification in affected versions.
How can I determine whether my instance is affected?
Review the LDAP authentication configuration for LDAP_TLS_NO_VERIFY=true and check whether the instance runs a version prior to 4.4.19 or a version from 4.5.0 through 4.5.11. If both conditions apply, Puma web processes may have certificate verification globally disabled.