CVE-2026-22245

High

Published: 08 January 2026

Published

08 January 2026

Modified

15 January 2026

KEV Added

—

Patch

—

CVSS Score v4 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0003 10.6th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22245 is a high-severity SSRF (CWE-918) vulnerability in Joinmastodon Mastodon. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-22245 is a server-side request forgery (SSRF) vulnerability in Mastodon, a free and open-source social network server based on ActivityPub. Mastodon performs numerous outbound HTTP requests to user-provided domains but includes protections to block requests to local IP addresses—unless explicitly allowed via the ALLOWED_PRIVATE_ADDRESSES configuration—to mitigate confused deputy risks. However, the blocklist omitted certain IP address ranges that could still resolve to loopback or local network hosts, enabling unauthorized requests to internal resources.

The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is classified under CWE-918. Any remote attacker with network access to a vulnerable Mastodon instance can exploit it without authentication or user interaction by supplying malicious domains resolving to the disallowed IP ranges. Successful exploitation allows the attacker to force the Mastodon server to make HTTP requests to loopback interfaces or local network services, potentially exposing sensitive private resources that would otherwise be inaccessible from the internet.

Mitigation is available through patches in Mastodon versions 4.5.4, 4.4.11, 4.3.17, and 4.2.29, which expand the disallowed IP ranges. The official security advisory (GHSA-xfrj-c749-jxxq) and corresponding GitHub commits detail the fixes, recommending immediate upgrades for all affected instances.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-1674

Vulnerability details

Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow requests to local IP addresses (unless specified in `ALLOWED_PRIVATE_ADDRESSES`)…

to avoid the "confused deputy" problem. The list of disallowed IP address ranges was lacking some IP address ranges that can be used to reach local IP addresses. An attacker can use an IP address in the affected ranges to make Mastodon perform HTTP requests against loopback or local network hosts, potentially allowing access to otherwise private resources and services. This is fixed in Mastodon v4.5.4, v4.4.11, v4.3.17 and v4.2.29.

CWE(s): CWE-918

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SSRF in public-facing Mastodon server directly matches T1190 for unauthenticated remote exploitation of an internet-facing application to reach internal resources.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1