CVE-2026-22245

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22245", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-07T05:19:12.920Z", "datePublished": "2026-01-08T15:23:13.639Z", "dateUpdated": "2026-01-08T15:54:30.680Z"}, "containers": {"cna": {"title": "Mastodon has SSRF Protection bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-xfrj-c749-jxxq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-xfrj-c749-jxxq"}, {"name": "https://github.com/mastodon/mastodon/commit/0f4e8a6240b5af1f2c3f34d2793d8610c6ef2aca", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/commit/0f4e8a6240b5af1f2c3f34d2793d8610c6ef2aca"}, {"name": "https://github.com/mastodon/mastodon/commit/17022907866710a72a1b1fc0a5ce9538bad1b4c3", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/commit/17022907866710a72a1b1fc0a5ce9538bad1b4c3"}, {"name": "https://github.com/mastodon/mastodon/commit/71ae4cf2cf5138ccdda64b1b1d665849b688686d", "tags": ["x_refsource_MISC"], "url": "https://github.com/mastodon/mastodon/commit/71ae4cf2cf5138ccdda64b1b1d665849b688686d"}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"version": "< 4.2.29", "status": "affected"}, {"version": ">= 4.3.0-beta.1, < 4.3.17", "status": "affected"}, {"version": ">= 4.4.0-beta.1, < 4.4.11", "status": "affected"}, {"version": ">= 4.5.0-beta.1, < 4.5.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T15:25:39.380Z"}, "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow requests to local IP addresses (unless specified in `ALLOWED_PRIVATE_ADDRESSES`) to avoid the \"confused deputy\" problem. The list of disallowed IP address ranges was lacking some IP address ranges that can be used to reach local IP addresses. An attacker can use an IP address in the affected ranges to make Mastodon perform HTTP requests against loopback or local network hosts, potentially allowing access to otherwise private resources and services. This is fixed in Mastodon v4.5.4, v4.4.11, v4.3.17 and v4.2.29."}], "source": {"advisory": "GHSA-xfrj-c749-jxxq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T15:50:12.992058Z", "id": "CVE-2026-22245", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T15:54:30.680Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22245", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T15:50:12.992058Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T15:50:17.103Z"}}], "cna": {"title": "Mastodon has SSRF Protection bypass", "source": {"advisory": "GHSA-xfrj-c749-jxxq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "mastodon", "product": "mastodon", "versions": [{"status": "affected", "version": "< 4.2.29"}, {"status": "affected", "version": ">= 4.3.0-beta.1, < 4.3.17"}, {"status": "affected", "version": ">= 4.4.0-beta.1, < 4.4.11"}, {"status": "affected", "version": ">= 4.5.0-beta.1, < 4.5.4"}]}], "references": [{"url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-xfrj-c749-jxxq", "name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-xfrj-c749-jxxq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mastodon/mastodon/commit/0f4e8a6240b5af1f2c3f34d2793d8610c6ef2aca", "name": "https://github.com/mastodon/mastodon/commit/0f4e8a6240b5af1f2c3f34d2793d8610c6ef2aca", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mastodon/mastodon/commit/17022907866710a72a1b1fc0a5ce9538bad1b4c3", "name": "https://github.com/mastodon/mastodon/commit/17022907866710a72a1b1fc0a5ce9538bad1b4c3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mastodon/mastodon/commit/71ae4cf2cf5138ccdda64b1b1d665849b688686d", "name": "https://github.com/mastodon/mastodon/commit/71ae4cf2cf5138ccdda64b1b1d665849b688686d", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow requests to local IP addresses (unless specified in `ALLOWED_PRIVATE_ADDRESSES`) to avoid the \"confused deputy\" problem. The list of disallowed IP address ranges was lacking some IP address ranges that can be used to reach local IP addresses. An attacker can use an IP address in the affected ranges to make Mastodon perform HTTP requests against loopback or local network hosts, potentially allowing access to otherwise private resources and services. This is fixed in Mastodon v4.5.4, v4.4.11, v4.3.17 and v4.2.29."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T15:25:39.380Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22245", "state": "PUBLISHED", "dateUpdated": "2026-01-08T15:54:30.680Z", "dateReserved": "2026-01-07T05:19:12.920Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-08T15:23:13.639Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mastodon", "vendor": "mastodon", "versions": [{"status": "affected", "version": "< 4.2.29"}, {"status": "affected", "version": ">= 4.3.0-beta.1, < 4.3.17"}, {"status": "affected", "version": ">= 4.4.0-beta.1, < 4.4.11"}, {"status": "affected", "version": ">= 4.5.0-beta.1, < 4.5.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "9DC30BD1-D8D8-4CA4-AC41-1AA95AADDBD3", "versionEndExcluding": "4.2.29", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "DEAC34A7-EB88-4E46-B5D6-F4EBB88CE049", "versionEndExcluding": "4.3.17", "versionStartIncluding": "4.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD92863A-CB76-45AA-BF4D-9870B24E8109", "versionEndExcluding": "4.4.11", "versionStartIncluding": "4.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E8FBAF5-C7BC-4980-9780-50BA935D126B", "versionEndExcluding": "4.5.4", "versionStartIncluding": "4.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow requests to local IP addresses (unless specified in `ALLOWED_PRIVATE_ADDRESSES`) to avoid the \"confused deputy\" problem. The list of disallowed IP address ranges was lacking some IP address ranges that can be used to reach local IP addresses. An attacker can use an IP address in the affected ranges to make Mastodon perform HTTP requests against loopback or local network hosts, potentially allowing access to otherwise private resources and services. This is fixed in Mastodon v4.5.4, v4.4.11, v4.3.17 and v4.2.29."}, {"lang": "es", "value": "Mastodon es un servidor de red social gratuito, de c\u00f3digo abierto, basado en ActivityPub. Por naturaleza, Mastodon realiza muchas solicitudes salientes a dominios proporcionados por el usuario. Mastodon, sin embargo, tiene alg\u00fan mecanismo de protecci\u00f3n para denegar solicitudes a direcciones IP locales (a menos que se especifique en 'ALLOWED_PRIVATE_ADDRESSES') para evitar el problema del 'diputado confundido'. La lista de rangos de direcciones IP no permitidas carec\u00eda de algunos rangos de direcciones IP que pueden usarse para alcanzar direcciones IP locales. Un atacante puede usar una direcci\u00f3n IP en los rangos afectados para hacer que Mastodon realice solicitudes HTTP contra hosts de bucle invertido o de red local, lo que podr\u00eda permitir el acceso a recursos y servicios que de otro modo ser\u00edan privados. Esto est\u00e1 corregido en Mastodon v4.5.4, v4.4.11, v4.3.17 y v4.2.29."}], "id": "CVE-2026-22245", "lastModified": "2026-06-17T10:19:37.570", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22245", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T15:50:12.992058Z", "version": "2.0.3"}}]}, "published": "2026-01-08T16:16:02.803", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mastodon/mastodon/commit/0f4e8a6240b5af1f2c3f34d2793d8610c6ef2aca"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mastodon/mastodon/commit/17022907866710a72a1b1fc0a5ce9538bad1b4c3"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mastodon/mastodon/commit/71ae4cf2cf5138ccdda64b1b1d665849b688686d"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-xfrj-c749-jxxq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:38:35.964102+00:00", "value": {"mitigation_remediation": ["Upgrade Mastodon to at least version 4.5.4 (or the appropriate branch\u2011specific release such as 4.4.11, 4.3.17, or 4.2.29).", "If an upgrade cannot be performed immediately, isolate the Mastodon instance from the internal network using firewall rules or a separate subnet to prevent outbound connections to private IP ranges.", "Review and tighten the ALLOWED_PRIVATE_ADDRESSES configuration so that only necessary private networks are allowed, ensuring the blacklist matches the latest security guidance."], "summary": {"action": "Patch", "impact": "Local Network Access via SSRF"}, "threat_synthesis": {"affected_systems": "The defect affects all Mastodon installations using versions that precede the published fixes: 4.5.4, 4.4.11, 4.3.17 and 4.2.29. Systems running earlier patch levels and not manually excluded certain private IP ranges are susceptible. Other platforms that incorporate the same outbound request logic without the updated whitelist are likely affected as well.", "description_and_impact": "The vulnerability is caused by an incomplete blacklist of private IP ranges in Mastodon's outbound request validation. This allows an attacker to provide an IP address that lies within the omitted ranges, causing the server to send HTTP requests to loopback or local network hosts. As a result, internal services or sensitive resources that are normally inaccessible from the public network could be queried by the attacker, enabling data exfiltration or further lateral movement. The weakness belongs to CWE\u2011918, which characterises Server\u2011Side Request Forgery where the target of an outbound request is not properly validated.", "risk_and_exploitability": "Mastodon assigns a CVSS score of 7.1, classifying the issue as High severity. The EPSS score is below 1\u2009%, indicating a very low but non\u2011zero probability of exploitation in the near term, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The SSRF attack vector requires the attacker to supply a crafted IP address that falls within the omitted private ranges, after which Mastodon will perform the outbound request. Successful exploitation can expose internal hosts or services which are normally protected, and depending on the internal network design, could be leveraged for further compromise. Given the low exploitation probability but significant potential impact, administrators should consider applying the available fixes promptly."}}}}, "created": "2026-01-09T13:24:52.868911+00:00", "updated": "2026-04-18T07:45:24.979836+00:00", "vendors": ["joinmastodon", "joinmastodon$PRODUCT$mastodon"]}