CVE-2026-72914: Mastodon DoS Vulnerability

CVE-2026-72914 Overview

CVE-2026-72914 is a resource exhaustion vulnerability in Mastodon, the open-source ActivityPub social network server. The flaw affects administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController. These controllers performed expensive SQL calculations before checking caller authorization. Anonymous attackers can send crafted keys, start_at, and end_at parameters to trigger long-running database queries. Repeated requests exhaust server CPU and database resources, leading to denial of service. The issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

Critical Impact
Unauthenticated attackers can trigger costly SQL operations across Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, degrading or halting service availability.

Affected Products

Mastodon versions prior to 4.4.21
Mastodon versions prior to 4.5.14 and 4.6.4
Mastodon 4.7.0 pre-release versions prior to 4.7.0-beta.1

Discovery Timeline

2026-08-10 - CVE-2026-72914 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72914

Vulnerability Analysis

The vulnerability [CWE-405: Asymmetric Resource Consumption (Amplification)] arises because Mastodon's administrative metrics controllers execute database-intensive logic before authorization checks complete. Both Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController invoke measurement classes during before_action callbacks. The verify_authorized check only runs after_action, so expensive queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension complete before Mastodon rejects the unauthorized caller.

An anonymous attacker submits crafted keys, start_at, and end_at values to force wide time-range aggregations. Each request consumes database CPU and connection capacity. Repeated requests exhaust the pool and degrade the instance for legitimate users.

Root Cause

The controllers instantiated metric objects using unauthenticated request parameters. Authorization was deferred until after data assembly, and parameters were read with params[:key] accessors that silently accept missing values. This design allowed attacker-controlled input to reach heavy query builders before any access check.

Attack Vector

The attack requires only network access to an exposed Mastodon instance. No credentials, user interaction, or prior privilege are required. An attacker sends repeated POST or GET requests to the admin measures and retention endpoints with parameters designed to widen query ranges or select many metric keys.

ruby

# Patch: app/controllers/api/v1/admin/measures_controller.rb
 def set_measures
   @measures = Admin::Metrics::Measure.retrieve(
-      params[:keys],
-      params[:start_at],
-      params[:end_at],
+      params.require(:keys),
+      params.require(:start_at),
+      params.require(:end_at),
     params
   )
 end

Source: Mastodon commit 18c61f2

The fix switches to params.require, which raises ActionController::ParameterMissing when parameters are absent. Combined with corrected authorization scoping, this prevents unauthenticated callers from reaching the expensive metric retrieval path.

ruby

# Patch: app/controllers/api/v1/admin/retention_controller.rb
  before_action -> { authorize_if_got_token! :'admin:read' }
-  before_action :set_cohorts
+  before_action :set_retention

  def create
    authorize :dashboard, :index?
-    render json: @cohorts, each_serializer: REST::Admin::CohortSerializer
+    render json: @retention.cohorts, each_serializer: REST::Admin::CohortSerializer
  end

  private

-  def set_cohorts
-    @cohorts = Admin::Metrics::Retention.new(
-      params[:start_at],
-      params[:end_at],
+  def set_retention
+    @retention = Admin::Metrics::Retention.new(
+      params.require(:start_at),
+      params.require(:end_at),
      params[:frequency]
-    ).cohorts
+    )
  end

Source: Mastodon commit 18c61f2

The retention controller patch defers cohort materialization until after serialization, so the authorize call runs before the expensive query fires.

Detection Methods for CVE-2026-72914

Indicators of Compromise

Repeated HTTP requests to /api/v1/admin/measures or /api/v1/admin/retention from unauthenticated sources
Sustained spikes in PostgreSQL CPU usage and long-running queries against metric aggregation tables
Request bodies containing wide start_at/end_at ranges or large keys arrays
Increased 401/403 responses from admin API endpoints without preceding authentication

Detection Strategies

Alert on unauthenticated requests to admin API paths reaching the Rails application layer
Correlate web server access logs with database slow query logs to identify amplification patterns
Baseline normal admin metric traffic volume and flag deviations exceeding standard thresholds

Monitoring Recommendations

Enable PostgreSQL log_min_duration_statement to capture queries running longer than expected
Track Puma or Sidekiq worker saturation and database connection pool exhaustion events
Forward Mastodon and reverse proxy logs to a central analytics platform for behavioral analysis

How to Mitigate CVE-2026-72914

Immediate Actions Required

Upgrade Mastodon to 4.4.21, 4.5.14, 4.6.4, or 4.7.0-beta.1 as appropriate for your release track
Restrict access to /api/v1/admin/* endpoints at the reverse proxy to trusted administrative IP ranges
Apply rate limiting to admin API paths to blunt repeated abusive requests

Patch Information

The Mastodon project addressed this issue in commits 18c61f2, 467c933, 930aa9f, and da47a1b. Fixed releases are published as v4.4.21, v4.5.14, v4.6.4, and v4.7.0-beta.1. See the GHSA-7jvv-fhmg-wpfw advisory for full details.

Workarounds

Block unauthenticated access to admin API endpoints at the reverse proxy or WAF layer
Configure aggressive rate limits on /api/v1/admin/measures and /api/v1/admin/retention
Restrict database statement timeouts to cap the impact of any single long-running query

bash

# Nginx: restrict admin API to trusted networks
location ~ ^/api/v1/admin/(measures|retention) {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://mastodon_backend;
}

# PostgreSQL: cap query duration to limit amplification impact
ALTER ROLE mastodon SET statement_timeout = '10s';