CVE-2026-72916: Mastodon Auth Bypass Vulnerability

CVE-2026-72916 Overview

CVE-2026-72916 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Mastodon, the open-source ActivityPub-based social network server. The flaw resides in the PrivateAddressCheck.private_address? method within app/lib/private_address_check.rb. The method normalizes IPv4-mapped IPv6 addresses but fails to recognize IPv4-compatible IPv6 addresses using IPAddr#ipv4_compat?. Attackers can supply an address in the omitted range to bypass the ALLOWED_PRIVATE_ADDRESSES protection. Successful exploitation causes Mastodon to send HTTP requests to loopback interfaces, potentially reaching internal services. The issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

Critical Impact
Attackers can bypass private-address filtering and coerce Mastodon into issuing HTTP requests to loopback and internal services, exposing private resources.

Affected Products

Mastodon versions prior to 4.4.21
Mastodon versions prior to 4.5.14
Mastodon versions prior to 4.6.4 and prior to 4.7.0-beta.1

Discovery Timeline

2026-08-10 - CVE-2026-72916 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72916

Vulnerability Analysis

Mastodon performs outbound HTTP requests for federation, media proxying, and link previews. To prevent SSRF, it validates destination addresses through PrivateAddressCheck.private_address? before issuing requests. The check inspects whether the target address falls within private or loopback ranges. The vulnerable implementation handles IPv4-mapped IPv6 addresses of the form ::ffff:127.0.0.1 but does not evaluate IPv4-compatible IPv6 addresses of the form ::127.0.0.1. Because IPAddr#ipv4_compat? is not invoked, addresses in the deprecated ::/96 range pass validation. On hosts where the kernel still routes IPv4-compatible IPv6 traffic, the request reaches the loopback interface or other internal services.

Root Cause

The defect is an incomplete allow-list check. PrivateAddressCheck.private_address? normalizes only one legacy IPv6 embedding format. IPv4-compatible IPv6 addresses, defined by RFC 4291 and formally deprecated, remain routable on some systems and are not translated to their IPv4 equivalents before comparison. The absence of an ipv4_compat? branch allows an attacker-supplied hostname or URL resolving to ::<ipv4> to bypass private-range filtering.

Attack Vector

An unauthenticated remote attacker submits a URL whose host resolves to an IPv4-compatible IPv6 address pointing at a private or loopback destination. Mastodon's outbound fetcher, believing the address to be public, issues an HTTP request. The request reaches internal services such as metadata endpoints, admin dashboards, or unauthenticated APIs bound to loopback. Exploitation depends on the underlying operating system still honoring the obsolete IPv4-compatible IPv6 mechanism, which is why the CVSS 4.0 attack complexity is rated High.

The fix adds recognition of IPv4-compatible IPv6 addresses within PrivateAddressCheck.private_address?. The patched routine converts such addresses to their IPv4 equivalent and re-evaluates them against the private-range list. See the GitHub Security Advisory GHSA-vwhj-3g83-v276 for the full technical write-up.

Detection Methods for CVE-2026-72916

Indicators of Compromise

Outbound HTTP requests from the Mastodon service originating toward loopback addresses (127.0.0.0/8) or private RFC 1918 ranges.
Application logs referencing URLs containing IPv6 literals in the ::<ipv4> form, such as http://[::127.0.0.1]/.
Fetch attempts by Mastodon workers (Sidekiq jobs LinkCrawlWorker, ActivityPub::FetchRemoteAccountService) toward internal hosts.

Detection Strategies

Inspect reverse proxy and application access logs for request URLs or Host headers containing IPv4-compatible IPv6 literals.
Monitor Sidekiq job payloads for remote object URIs whose resolved address is inside private ranges.
Correlate egress firewall telemetry with Mastodon process identifiers to catch attempts to reach internal services.

Monitoring Recommendations

Enable egress filtering on the Mastodon host so only expected external destinations are reachable, blocking loopback and RFC 1918 targets at the network layer.
Alert on any DNS resolution by the Mastodon service that returns an address in ::/96 other than ::1.
Retain HTTP client logs long enough to reconstruct SSRF probing attempts across federated interactions.

How to Mitigate CVE-2026-72916

Immediate Actions Required

Upgrade Mastodon to 4.4.21, 4.5.14, 4.6.4, or 4.7.0-beta.1 depending on the deployed release branch.
Audit ALLOWED_PRIVATE_ADDRESSES environment configuration and remove entries that are no longer required.
Restart Sidekiq workers and web processes after upgrading so the patched PrivateAddressCheck module is loaded.

Patch Information

The maintainers released fixed builds available on GitHub: Mastodon Release v4.4.21, Mastodon Release v4.5.14, Mastodon Release v4.6.4, and Mastodon Beta Release v4.7.0-beta.1. The corrective changes are tracked in commits 18c61f28, 467c9334, 930aa9fe, and da47a1bd.

Workarounds

Disable IPv4-compatible IPv6 routing on the host kernel where the Mastodon service runs, since exploitation requires this obsolete mechanism.
Enforce a strict egress firewall policy that blocks loopback, link-local, and RFC 1918 destinations from the Mastodon service account.
Place the Mastodon instance in a dedicated network namespace with no route to internal services until the upgrade is applied.

bash

# Verify installed Mastodon version and confirm the fix is deployed
cd /home/mastodon/live
cat lib/mastodon/version.rb | grep -E 'MAJOR|MINOR|PATCH|FLAGS'

# Example nftables rule blocking loopback egress from the mastodon user
nft add rule inet filter output skuid mastodon ip daddr 127.0.0.0/8 drop
nft add rule inet filter output skuid mastodon ip6 daddr ::1 drop