CVE-2026-46348

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-46348
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46348.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-46348
Aliases
Published
2026-06-24T19:39:46.332Z
Modified
2026-07-08T08:11:21.018948163Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)
Details

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, the list of disallowed IP address ranges was lacking an IP address range that can be used to reach local IP addresses. An attacker can use an IP address in the affected range to make Mastodon perform HTTP requests against loopback interfaces, potentially allowing access to otherwise private resources and services. This vulnerability is fixed in 4.5.10, 4.4.17, and 4.3.23.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46348.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ]
}
References

Affected packages

Git / github.com/mastodon/mastodon

Affected ranges

Type
GIT
Repo
https://github.com/mastodon/mastodon
Events
Introduced
5a8ab0a3e62a8825e28bb74c1760ba6488d20c97
Fixed
f80b1ba92e63c3da771b405b9100f5c9abda909f
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "4.5.0-beta.1"
        },
        {
            "fixed": "4.5.10"
        }
    ]
}

Affected versions

v4.*
v4.5.0
v4.5.0-beta.1
v4.5.0-beta.2
v4.5.0-rc.1
v4.5.0-rc.2
v4.5.0-rc.3
v4.5.1
v4.5.2
v4.5.3
v4.5.4
v4.5.5
v4.5.6
v4.5.7
v4.5.8
v4.5.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46348.json"