CVE-2026-22245

High

Published: 08 January 2026

Published

08 January 2026

Modified

15 January 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0005 16.7th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22245 is a high-severity SSRF (CWE-918) vulnerability in Joinmastodon Mastodon. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190).

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing

addresses: CWE-918

Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.

SC-7 Boundary Protection

addresses: CWE-918

Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

SI-10 Information Input Validation

addresses: CWE-918

Validates server-side URLs and resource references to block SSRF attempts.

SI-4 System Monitoring

addresses: CWE-918

Detects server-side request forgery through monitoring of unexpected outbound connections.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SSRF in public-facing Mastodon server directly matches T1190 for unauthenticated remote exploitation of an internet-facing application to reach internal resources.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow requests to local IP addresses (unless specified in `ALLOWED_PRIVATE_ADDRESSES`)…

to avoid the "confused deputy" problem. The list of disallowed IP address ranges was lacking some IP address ranges that can be used to reach local IP addresses. An attacker can use an IP address in the affected ranges to make Mastodon perform HTTP requests against loopback or local network hosts, potentially allowing access to otherwise private resources and services. This is fixed in Mastodon v4.5.4, v4.4.11, v4.3.17 and v4.2.29.

Deeper analysisAI

CVE-2026-22245 is a server-side request forgery (SSRF) vulnerability in Mastodon, a free and open-source social network server based on ActivityPub. Mastodon performs numerous outbound HTTP requests to user-provided domains but includes protections to block requests to local IP addresses—unless explicitly allowed via the ALLOWED_PRIVATE_ADDRESSES configuration—to mitigate confused deputy risks. However, the blocklist omitted certain IP address ranges that could still resolve to loopback or local network hosts, enabling unauthorized requests to internal resources.

The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is classified under CWE-918. Any remote attacker with network access to a vulnerable Mastodon instance can exploit it without authentication or user interaction by supplying malicious domains resolving to the disallowed IP ranges. Successful exploitation allows the attacker to force the Mastodon server to make HTTP requests to loopback interfaces or local network services, potentially exposing sensitive private resources that would otherwise be inaccessible from the internet.

Mitigation is available through patches in Mastodon versions 4.5.4, 4.4.11, 4.3.17, and 4.2.29, which expand the disallowed IP ranges. The official security advisory (GHSA-xfrj-c749-jxxq) and corresponding GitHub commits detail the fixes, recommending immediate upgrades for all affected instances.