BIT-mastodon-2026-47389: Mastodon: SSRF protection bypass on older Ruby versions
Mastodon versions prior to 4.5.10, 4.4.17, and 4.3.23 using Ruby versions older than 3.4 have a Server-Side Request Forgery (SSRF) protection bypass. The vulnerability arises because PrivateAddressCheck.private_address? incorrectly returns false for IPv4-mapped IPv6 addresses, allowing attackers controlling DNS to redirect HTTP fetches to private IPv4 addresses such as loopback or cloud metadata endpoints. This issue is fixed in Mastodon versions 4.5.10, 4.4.17, and 4.3.23.
AI Analysis
Technical Summary
Mastodon is vulnerable to an SSRF protection bypass in versions prior to 4.5.10, 4.4.17, and 4.3.23 when running on Ruby versions older than 3.4. The vulnerability is due to the PrivateAddressCheck.private_address? method returning false for IPv4-mapped IPv6 addresses (::ffff:a.b.c.d) that correspond to private IPv4 addresses. An attacker who controls DNS can publish an AAAA record with such an address, causing Mastodon to make outbound HTTP requests to internal or sensitive IP addresses like 127.0.0.1 or 169.254.169.254. This can lead to unauthorized access to internal services. The vulnerability is fixed in the specified Mastodon versions.
Potential Impact
An attacker controlling DNS can exploit this vulnerability to bypass SSRF protections and cause Mastodon to make HTTP requests to internal IP addresses, including loopback and cloud metadata endpoints. This can potentially expose sensitive internal services or data accessible only from the server's network. The impact is high due to the ability to reach protected internal resources.
Mitigation Recommendations
Upgrade Mastodon to version 4.5.10, 4.4.17, or 4.3.23 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in these versions.
BIT-mastodon-2026-47389: Mastodon: SSRF protection bypass on older Ruby versions
Description
Mastodon versions prior to 4.5.10, 4.4.17, and 4.3.23 using Ruby versions older than 3.4 have a Server-Side Request Forgery (SSRF) protection bypass. The vulnerability arises because PrivateAddressCheck.private_address? incorrectly returns false for IPv4-mapped IPv6 addresses, allowing attackers controlling DNS to redirect HTTP fetches to private IPv4 addresses such as loopback or cloud metadata endpoints. This issue is fixed in Mastodon versions 4.5.10, 4.4.17, and 4.3.23.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Mastodon is vulnerable to an SSRF protection bypass in versions prior to 4.5.10, 4.4.17, and 4.3.23 when running on Ruby versions older than 3.4. The vulnerability is due to the PrivateAddressCheck.private_address? method returning false for IPv4-mapped IPv6 addresses (::ffff:a.b.c.d) that correspond to private IPv4 addresses. An attacker who controls DNS can publish an AAAA record with such an address, causing Mastodon to make outbound HTTP requests to internal or sensitive IP addresses like 127.0.0.1 or 169.254.169.254. This can lead to unauthorized access to internal services. The vulnerability is fixed in the specified Mastodon versions.
Potential Impact
An attacker controlling DNS can exploit this vulnerability to bypass SSRF protections and cause Mastodon to make HTTP requests to internal IP addresses, including loopback and cloud metadata endpoints. This can potentially expose sensitive internal services or data accessible only from the server's network. The impact is high due to the ability to reach protected internal resources.
Mitigation Recommendations
Upgrade Mastodon to version 4.5.10, 4.4.17, or 4.3.23 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in these versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-mastodon-2026-47389
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-47389"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
- Cvss Version
- null
Threat ID: 6a4c347427e9c79719603a9c
Added to database: 07/06/2026, 23:04:20 UTC
Last enriched: 07/06/2026, 23:37:15 UTC
Last updated: 07/07/2026, 00:47:42 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.