Mastodon: Unwanted deactivation of SSL/TLS certificate verification (CVE-2026-59825)
Mastodon versions prior to 4.4.19 and from 4.5.0 up to but not including 4.5.12 contain a vulnerability where SSL/TLS certificate verification can be globally disabled for requests made by puma web processes when LDAP authentication is configured with LDAP_TLS_NO_VERIFY=true. This occurs due to mutation of OpenSSL::SSL::SSLContext::DEFAULT_PARAMS in the LDAP authentication code. The issue does not affect sidekiq background jobs. The vulnerability is fixed in versions 4.4.19 and 4.5.12.
AI Analysis
Technical Summary
Mastodon's LDAP authentication implementation in app/models/concerns/user/ldap_authenticable.rb modifies the global OpenSSL SSLContext default parameters when LDAP_TLS_NO_VERIFY=true is set, disabling SSL/TLS certificate verification for all requests handled by puma web processes. This affects Mastodon versions before 4.4.19 and versions from 4.5.0 up to 4.5.12. Sidekiq background jobs are not affected by this change. The vulnerability allows unwanted deactivation of SSL/TLS verification, potentially exposing communications to man-in-the-middle attacks. The issue is resolved in Mastodon versions 4.4.19 and 4.5.12.
Potential Impact
Disabling SSL/TLS certificate verification globally for puma web processes can lead to insecure communications and potential man-in-the-middle attacks during LDAP authentication or other network requests made by these processes. This undermines the security guarantees of TLS and can expose sensitive data or credentials. Sidekiq background jobs remain unaffected, limiting the scope of the impact to web request handling processes.
Mitigation Recommendations
Upgrade Mastodon to version 4.4.19 or later if using the 4.4.x branch, or to version 4.5.12 or later if using the 4.5.x branch. These versions contain the official fix that prevents global mutation of SSLContext default parameters and restores proper SSL/TLS certificate verification behavior. No other mitigation is required once patched.
Mastodon: Unwanted deactivation of SSL/TLS certificate verification (CVE-2026-59825)
Description
Mastodon versions prior to 4.4.19 and from 4.5.0 up to but not including 4.5.12 contain a vulnerability where SSL/TLS certificate verification can be globally disabled for requests made by puma web processes when LDAP authentication is configured with LDAP_TLS_NO_VERIFY=true. This occurs due to mutation of OpenSSL::SSL::SSLContext::DEFAULT_PARAMS in the LDAP authentication code. The issue does not affect sidekiq background jobs. The vulnerability is fixed in versions 4.4.19 and 4.5.12.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Mastodon's LDAP authentication implementation in app/models/concerns/user/ldap_authenticable.rb modifies the global OpenSSL SSLContext default parameters when LDAP_TLS_NO_VERIFY=true is set, disabling SSL/TLS certificate verification for all requests handled by puma web processes. This affects Mastodon versions before 4.4.19 and versions from 4.5.0 up to 4.5.12. Sidekiq background jobs are not affected by this change. The vulnerability allows unwanted deactivation of SSL/TLS verification, potentially exposing communications to man-in-the-middle attacks. The issue is resolved in Mastodon versions 4.4.19 and 4.5.12.
Potential Impact
Disabling SSL/TLS certificate verification globally for puma web processes can lead to insecure communications and potential man-in-the-middle attacks during LDAP authentication or other network requests made by these processes. This undermines the security guarantees of TLS and can expose sensitive data or credentials. Sidekiq background jobs remain unaffected, limiting the scope of the impact to web request handling processes.
Mitigation Recommendations
Upgrade Mastodon to version 4.4.19 or later if using the 4.4.x branch, or to version 4.5.12 or later if using the 4.5.x branch. These versions contain the official fix that prevents global mutation of SSLContext default parameters and restores proper SSL/TLS certificate verification behavior. No other mitigation is required once patched.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-mastodon-2026-59825
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-59825"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
- Cvss Version
- null
Threat ID: 6a8c4c6dacd9273b499c0a2c
Added to database: 08/24/2026, 13:51:41 UTC
Last enriched: 08/24/2026, 14:24:46 UTC
Last updated: 08/24/2026, 22:52:12 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.