CVE-2026-72916 in Mastodon
Summary
by MITRE • 08/11/2026
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/lib/private_address_check.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. An attacker could supply an address in the omitted range to bypass the ALLOWED_PRIVATE_ADDRESSES protection and make Mastodon send HTTP requests to loopback interfaces, potentially accessing private resources and services. Exploitation requires a system that supports the obsolete IPv4-compatible IPv6 mechanism. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in Mastodon's private address checking functionality represents a critical security flaw that undermines the intended protection of allowed private addresses. This issue affects versions prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 where the PrivateAddressCheck.private_address? method in app/lib/private_address_check.rb demonstrates inconsistent handling of IPv6 address normalization. The flaw specifically occurs when processing IPv4-mapped IPv6 addresses while failing to recognize IPv4-compatible IPv6 addresses that utilize the IPAddr#ipv4_compat? method, creating a significant gap in the security boundary.
The technical implementation flaw stems from incomplete address validation logic within the private address checking system. When an attacker supplies an IPv4-compatible IPv6 address that is not properly detected by the current validation mechanism, the system incorrectly classifies these addresses as non-private, thereby bypassing the ALLOWED_PRIVATE_ADDRESSES protection. This misclassification allows malicious actors to craft requests that appear to originate from private network addresses while actually targeting loopback interfaces, potentially enabling unauthorized access to internal services and resources that should remain protected behind firewall boundaries.
This vulnerability exposes Mastodon servers to potential exploitation scenarios where attackers can leverage the obsolete IPv4-compatible IPv6 mechanism to circumvent security controls designed to prevent access to private network resources. The operational impact extends beyond simple bypass of access controls, as it could enable attackers to perform reconnaissance activities against internal services, potentially leading to information disclosure or further compromise of systems that are typically isolated from external networks. The requirement for system support of the obsolete IPv4-compatible IPv6 mechanism means that exploitation is limited to environments where this legacy functionality remains enabled, but such systems still represent valid attack vectors within many network architectures.
The security implications align with CWE-284 access control vulnerabilities and demonstrate characteristics consistent with MITRE ATT&CK technique T1071.004 application layer protocols for lateral movement. Organizations should prioritize updating their Mastodon installations to versions 4.4.21, 4.5.14, 4.6.4, or 4.7.0-beta.1 where the patched implementation properly handles both IPv4-mapped and IPv4-compatible IPv6 addresses through comprehensive address validation. Additional mitigations may include network-level restrictions on outbound HTTP requests from Mastodon servers and monitoring for unusual patterns of internal network access attempts that could indicate exploitation attempts against this vulnerability.