Cyber Resilience

CVE-2026-27477

SSRF in Joinmastodon Mastodon 4.4.0 – 4.4.14

Published
24 February 2026
Modified
26 February 2026
Patch / advisory
CVSS Score v4 4.6
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0027 19th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-27477 is a medium-severity SSRF (CWE-918) vulnerability in Joinmastodon Mastodon. Its CVSS base score is 4.6 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 through 4.4.13 and 4.5.0 through 4.5.6, an unauthenticated attacker can register a FASP with an attacker-chosen `base_url` that…

more

includes or resolves to a local / internal address, leading to the Mastodon server making requests to that address. This only affects Mastodon servers that have opted in to testing the experimental FASP feature by setting the environment variable `EXPERIMENTAL_FEATURES` to a value including `fasp`. An attacker can force the Mastodon server to make http(s) requests to internal systems. While they cannot control the full URL that is being requested (only the prefix) and cannot see the result of those requests, vulnerabilities or other undesired behavior could be triggered in those systems. The fix is included in the 4.4.14 and 4.5.7 releases. Admins that are actively testing the experimental "fasp" feature should update their systems. Servers not using the experimental feature flag `fasp` are not affected.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct SSRF (CWE-918) in public-facing Mastodon server enables forced internal HTTP requests via unauthenticated FASP registration.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-22245Same product: Joinmastodon Mastodon
CVE-2026-25540Same product: Joinmastodon Mastodon
CVE-2026-41259Same product: Joinmastodon Mastodon
CVE-2026-23964Same product: Joinmastodon Mastodon
CVE-2026-22246Same product: Joinmastodon Mastodon
CVE-2023-42450Same product: Joinmastodon Mastodon
CVE-2026-33869Same product: Joinmastodon Mastodon
CVE-2026-23962Same product: Joinmastodon Mastodon
CVE-2026-27468Same product: Joinmastodon Mastodon
CVE-2024-34535Same product: Joinmastodon Mastodon

Affected Assets

joinmastodon
mastodon
4.4.0 — 4.4.14 · 4.5.0 — 4.5.7

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • AC-4 Information Flow Enforcement
  • SC-7 Boundary Protection
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.3.6
  • V1.5.3
  • V5.3.2
  • V10.4.7

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces validation of the attacker-supplied base_url to reject internal/local addresses before any outbound request is made.

prevent

Enforces policy-based information flow rules that can block or restrict the server-initiated HTTP requests to internal addresses.

prevent

Boundary protection mechanisms (egress filtering) can deny or log the unauthorized outbound connections to internal systems.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure development practices directly include input validation and destination allow-listing that prevent SSRF.

DE.CM-09 partial match
prevents

Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.

ID.RA-01 partial match
prevents

Vulnerability identification processes can discover and record SSRF flaws in web applications.

PR.IR-01 partial match
prevents

Network segmentation and egress controls can limit the damage from successful SSRF requests.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Operational threat data describing SSRF campaigns can be used to tighten outbound-request allow-lists and detection rules before attackers exploit them.

References