CVE-2026-46349: Mastodon Linked-Data Signature Spoofing Vulnerability

Technical summary

The vulnerability stems from insufficient normalization of ActivityPub activities that carry Linked-Data Signatures. Linked-Data Signatures cryptographically sign JSON-LD objects, but JSON-LD can represent the same data in multiple structurally different ways. Mastodon's validation does not account for the full range of these normalization ambiguities, allowing an attacker to rearrange key-value pairs, restructure nested objects, or alter array orderings in a signed activity without invalidating the signature. The cryptographic proof remains intact even though the semantic meaning to Mastodon's processing engine changes. This is a signature canonicalization bypass—the signature was computed over one canonical form, but the server accepts a different canonical form as equivalent.

Business impact

For a Mastodon instance operator, this vulnerability creates a spoofing vector that could undermine trust in federated identity and message authenticity. An attacker could craft manipulated activities that appear to originate from legitimate remote accounts, potentially enabling impersonation, unauthorized endorsements, or social engineering attacks within the Fediverse. However, the CVSS score of 5.3 reflects that integrity is the primary concern; confidentiality and availability are not directly compromised. Organizations running Mastodon should prioritize patching, particularly instances serving high-profile or sensitive communities where impersonation carries reputational or operational risk.

Affected systems

Mastodon versions 4.5.9 and earlier, 4.4.16 and earlier, and 4.3.22 and earlier are vulnerable. Version 4.3.x is EOL for most deployments, but any instance still running it is affected. The vulnerability affects self-hosted Mastodon instances and any platform that relies on Mastodon's federation logic. Hosted Mastodon services (such as those on mastodon.social) should apply patches promptly, but individual instances are responsible for their own upgrades.

Exploitability

Exploitation requires no special privileges or user interaction. An attacker can craft a malicious ActivityPub activity from an external server and send it to a vulnerable Mastodon instance; Mastodon will validate the signature incorrectly and process the manipulated message. The attack surface is the federation protocol itself—any public Mastodon instance that accepts activities from remote servers is exposed. The barrier to entry is moderate; an attacker needs understanding of JSON-LD, ActivityPub, and Linked-Data Signature mechanics, but no zero-day toolkit or advanced exploit code is required. The attack is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no widespread active exploitation has been disclosed as of the advisory date.

Remediation

Upgrade to Mastodon 4.5.10, 4.4.17, or 4.3.23 depending on your current version branch. These releases patch the signature validation logic to properly normalize incoming activities and prevent the canonicalization bypass. After upgrading, no further configuration changes are needed. Instance administrators should plan upgrades during low-traffic windows if possible, as federation processing may be temporarily affected during the transition.

Patch guidance

1. Identify your current Mastodon version (visible in the admin UI under 'About'). 2. Determine the appropriate target version: if running 4.5.x, upgrade to 4.5.10 or later; if running 4.4.x, upgrade to 4.4.17 or later; if running 4.3.x, upgrade to 4.3.23 or later. 3. Back up your database and configuration files. 4. Follow the Mastodon upgrade documentation for your deployment method (Docker, bare metal, etc.), which typically involves pulling the latest code, running migrations, and restarting services. 5. Test federation by sending a message to a remote Mastodon instance and confirming it displays correctly. 6. Monitor instance logs for any signature validation errors in the days following the upgrade.

Detection guidance

Monitor ActivityPub activity logs for unusual patterns in incoming Create, Update, or Announce activities from external servers. Look for activities with restructured or reordered JSON properties relative to the origin server's reported structure. If your instance supports debug logging for ActivityPub signature validation, enable it temporarily and check for mismatches between the claimed canonicalization and the actual normalized form used in validation. Network-level detection is limited because exploitation occurs at the application layer, but anomalous federation behavior (e.g., sudden spoofed messages appearing to come from high-profile accounts) may be a trailing indicator.

Why prioritize this

Although the CVSS score is moderate (5.3), the vulnerability should be patched promptly because it directly threatens the integrity of federated identity and message authenticity—core trust properties of the Fediverse. Even without active exploitation, the attack is trivial to execute and could be weaponized by state or criminal actors seeking to inject disinformation or compromise account reputation at scale. The patch is straightforward to deploy, reducing friction in prioritization.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects the following factors: Attack Vector is Network (AV:N), Attack Complexity is Low (AC:L), and no special privileges or user interaction are required (PR:N, UI:N), all of which push severity upward. However, the impact is limited to Integrity (I:L); Confidentiality and Availability are unaffected (C:N, A:N). The scope is unchanged (S:U), meaning the vulnerability does not cross privilege boundaries. The result is a MEDIUM severity rating that emphasizes the vulnerability is serious but not critical.

Frequently asked questions