CVE-2026-50128 Overview
CVE-2026-50128 affects Mastodon, the open-source federated social network server based on ActivityPub. The vulnerability allows attackers to bypass Linked Data Signatures verification on the toot:attributionDomains property. An error in how Mastodon defines the attributionDomains JSON-LD term renders signature validation ineffective for that field. Attackers can modify the attributionDomains value of a legitimately signed Update activity without invalidating the signature. The flaw exists in versions from 4.3.0 up to 4.5.11 and 4.4.18, where it is patched. The issue is categorized under [CWE-354] Improper Validation of Integrity Check Value.
Critical Impact
Attackers can forge attribution claims on signed federated activities, enabling false website-to-author associations and undermining Mastodon's federation trust model.
Affected Products
- Mastodon versions 4.3.0 through 4.5.10
- Mastodon versions 4.4.0 through 4.4.17
- Federated instances processing remote Update activities with Linked Data Signatures
Discovery Timeline
- 2026-06-24 - CVE-2026-50128 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-50128
Vulnerability Analysis
Mastodon implements the attributionDomains feature to allow websites to credit authors of their articles. The mechanism relies on a JSON-LD term defined by Mastodon to bind the domain claim to ActivityPub activities. To prevent forgery during federation, Mastodon uses Linked Data Signatures (LDS) to cryptographically sign properties of outgoing activities. Receiving servers verify the signature against the JSON-LD canonicalized form of the activity payload.
The attributionDomains term is defined incorrectly in Mastodon's JSON-LD context, causing the property to fall outside the canonicalization scope used by LDS. As a result, the signature does not cover the toot:attributionDomains field. An attacker intercepting or replaying a legitimately signed Update activity can substitute arbitrary attribution domain values while preserving signature validity. The integrity assumption that signed activities cannot be tampered with downstream no longer holds for this property.
Root Cause
The root cause is improper definition of the attributionDomains JSON-LD term in Mastodon's context document. Linked Data Signatures rely on deterministic canonicalization of typed properties. When a term is not correctly registered, its values are dropped from the signed graph. The result is silent omission rather than verification failure, classified as improper validation of an integrity check value [CWE-354].
Attack Vector
The attack is network-based and requires no authentication or user interaction. An adversary obtains a signed Update activity authored by a legitimate actor through normal federation traffic. The attacker rewrites the attributionDomains value to attribute the activity to a domain they control or wish to defame. The modified activity is relayed to target Mastodon instances, which accept it because signature verification on the manipulated field succeeds vacuously. Downstream consumers honor the forged attribution claim when rendering article credit metadata.
No verified exploit code is publicly available. See the GitHub Security Advisory GHSA-rwcw-vq68-g34p for vendor-confirmed technical details.
Detection Methods for CVE-2026-50128
Indicators of Compromise
- Inbound Update ActivityPub payloads where attributionDomains values differ from prior Create activities for the same object
- Federated activities containing attributionDomains referencing domains unrelated to the signing actor's host
- Anomalous churn or rewrites of toot:attributionDomains on otherwise stable posts
Detection Strategies
- Log and diff the attributionDomains field across the lifecycle of each federated object to identify post-signature mutation
- Compare the originating actor domain against claimed attributionDomains values and alert on mismatches
- Inspect inbound ActivityPub traffic for Update activities that modify only the attributionDomains property while preserving a valid signature
Monitoring Recommendations
- Forward Mastodon production.log and federation worker logs to a centralized analytics platform for correlation
- Track the version string reported by /api/v2/instance across known peers and flag instances still running vulnerable releases
- Monitor outbound abuse reports and moderation queues for unexpected attribution claims tied to your domain
How to Mitigate CVE-2026-50128
Immediate Actions Required
- Upgrade Mastodon to version 4.5.11 or 4.4.18 to apply the corrected JSON-LD term definition
- Audit recent inbound Update activities for tampering with the attributionDomains field
- Notify federated peers running affected versions to coordinate patching across your trust graph
Patch Information
The Mastodon maintainers released fixes in versions 4.5.11 and 4.4.18. The patch corrects the JSON-LD context definition so that toot:attributionDomains is included in the canonicalized graph protected by Linked Data Signatures. Refer to the GitHub Security Advisory GHSA-rwcw-vq68-g34p for the full changeset and upgrade instructions.
Workarounds
- No vendor-supplied workaround exists short of upgrading to a patched release
- Operators may temporarily disable display or downstream consumption of attributionDomains metadata until the patch is applied
- Restrict federation with untrusted instances if attribution integrity is critical to your deployment
# Upgrade Mastodon to a patched release
cd /home/mastodon/live
git fetch --tags
git checkout v4.5.11 # or v4.4.18 for the 4.4.x branch
bundle install
yarn install --frozen-lockfile
RAILS_ENV=production bundle exec rails db:migrate
RAILS_ENV=production bundle exec rails assets:precompile
sudo systemctl restart mastodon-web mastodon-sidekiq mastodon-streaming
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
