CVE-2026-72916
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In Mastodon before versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? does not recognize IPv4-compatible IPv6 addresses, allowing an attacker to bypass ALLOWED_PRIVATE_ADDRESSES protection and send HTTP requests to loopback interfaces, potentially accessing private resources. Exploitation requires a system supporting the obsolete IPv4-compatible IPv6 mechanism.
Risk Assessment
Potential access to internal services and resources, which could lead to data leakage or further attacks within the internal network.
Recommendation
Upgrade Mastodon to versions 4.4.21, 4.5.14, 4.6.4, or 4.7.0-beta.1 where this issue is fixed.
Original NVD description (English source)
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/lib/private_address_check.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. An attacker could supply an address in the omitted range to bypass the ALLOWED_PRIVATE_ADDRESSES protection and make Mastodon send HTTP requests to loopback interfaces, potentially accessing private resources and services. Exploitation requires a system that supports the obsolete IPv4-compatible IPv6 mechanism. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.