CVE-2026-46348

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.5.10 Mastodon versions prior to 4.4.17 Mastodon versions prior to 4.3.23

Description Mastodon is a free, open-source social network server based on ActivityPub. The software fails to include a specific IP address range in its list of disallowed ranges, which can be used to reach local IP addresses. This allows an attacker to trigger HTTP requests against loopback interfaces, potentially granting access to private resources and services. This is a Server-Side Request Forgery (SSRF), a technique where an attacker induces a server-side application to make requests to an unintended location.

Recommendations Update to version 4.5.10. Update to version 4.4.17. Update to version 4.3.23.