Mastodon, an open-source social network server, had an SSRF vulnerability identified as CVE-2026-46348. The vulnerability arises because the list of disallowed IP address ranges did not include an IPv6 unspecified address range that could be used to reach local IP addresses. This allowed attackers to bypass SSRF protections and cause the server to make HTTP requests to loopback interfaces, potentially exposing internal services. The vulnerability affects Mastodon versions >=4.5.0 and <4.5.10 and is fixed in version 4.5.10 (and similarly in 4.4.17 and 4.3.23).

An attacker can exploit this vulnerability to perform server-side request forgery (SSRF) that bypasses IP address filtering, enabling HTTP requests to local loopback interfaces. This may lead to unauthorized access to internal services or resources that are otherwise inaccessible from outside the server.

Upgrade Mastodon to version 4.5.10 or later (or 4.4.17, 4.3.23 or later for those branches) where this vulnerability is fixed. Patch availability is confirmed by the vendor's versioning information. No additional mitigation is required once upgraded.