CVE-2026-47389: Mastodon DNS SSRF via IPv4-Mapped IPv6 – Patch Now

Technical summary

The vulnerability exploits how Ruby versions before 3.4 handle IPv4-mapped IPv6 addresses in the PrivateAddressCheck.private_address? method. When Mastodon performs outbound HTTP fetches (e.g., during content validation, link preview generation, or WebFinger lookups), it checks whether the resolved IP is private to prevent SSRF attacks. However, addresses in the form ::ffff:a.b.c.d that map to RFC1918 ranges, loopback (127.0.0.1), or link-local space (169.254.169.254) are incorrectly classified as public. An attacker controlling authoritative DNS for any domain can publish an AAAA record with such a mapped address, causing Mastodon to open a TCP connection to the underlying IPv4 address—potentially reaching cloud metadata endpoints or other internal infrastructure.

Business impact

A compromised Mastodon instance could leak sensitive operational data. Cloud-hosted Mastodon deployments are at particular risk: accessing 169.254.169.254 may expose temporary AWS credentials, Azure managed identity tokens, or GCP metadata that an attacker could then use to pivot into the hosting infrastructure. Private networks containing internal services (databases, monitoring systems, CI/CD infrastructure) become reachable from the Mastodon process. The attack requires only DNS control over a domain that Mastodon processes—a low bar if users post links to attacker-controlled sites or if the attacker compromises a registrar.

Affected systems

Mastodon versions prior to 4.5.10, 4.4.17, and 4.3.23 are affected. The vulnerability manifests only when running on Ruby versions older than 3.4. Older Ruby versions commonly used in production include Ruby 3.3, 3.2, 3.1, and 3.0. Instances already on Ruby 3.4+ are not vulnerable regardless of Mastodon version. Administrators should verify both their Mastodon version and Ruby runtime.

Exploitability

Exploitability is high. The attack requires only DNS control—obtained through domain ownership, DNS hijacking, or registrar compromise—and no authentication or user interaction beyond normal Mastodon operation (processing links in posts or federation). The barrier to weaponization is low: an attacker publishes a malicious AAAA record and waits for Mastodon to fetch content pointing to that domain. No CVE has been added to CISA's Known Exploited Vulnerabilities catalog as of publication date.

Remediation

Upgrade Mastodon to 4.5.10, 4.4.17, or 4.3.23 or later. For instances unable to upgrade immediately, update Ruby to version 3.4 or newer, which correctly handles IPv4-mapped IPv6 addresses in PrivateAddressCheck. Verify your current Ruby version via ruby --version and Mastodon version in the web interface or config.

Patch guidance

Apply patches in this order: (1) Update Ruby to 3.4+ if feasible and your instance supports it—test in a staging environment first. (2) Upgrade Mastodon to the minimum patched version matching your current branch: 4.5.10 (for 4.5.x), 4.4.17 (for 4.4.x), or 4.3.23 (for 4.3.x). (3) Restart all Mastodon processes. Follow your instance's deployment method (Docker, systemd, etc.) and test federation with a remote instance post-patch to confirm no regressions. Verify patch application: mastodon-cli version should show the updated version number.

Detection guidance

Monitor outbound HTTP(S) requests from Mastodon processes to private IP ranges, particularly 169.254.169.254 and 127.0.0.1, using network flow logs or host-based IDS. Search firewall and proxy logs for HTTP requests originating from Mastodon servers to link-local or RFC1918 addresses. If cloud-hosted, audit IAM logs for unexpected credential access following the vulnerability publication date. Check Mastodon logs for unusual WebFinger or link-fetch errors correlating with DNS lookups to attacker domains.

Why prioritize this

HIGH severity (CVSS 8.6) due to the breadth of reachable targets (confidentiality impact on cloud metadata and private services) and the ease of exploitation (DNS control only). Cloud-hosted Mastodon instances should prioritize this immediately; on-premises instances with strong network segmentation and no cloud metadata endpoints may defer slightly but should still patch within days.

Risk score, explained

CVSS 3.1 score of 8.6 (HIGH) reflects: Attack Vector Network (exploitable remotely via DNS), Attack Complexity Low (no special conditions), Privileges Required None, User Interaction None, Scope Changed (can reach systems beyond Mastodon), Confidentiality Impact High (sensitive metadata exposed), Integrity None, Availability None. The score appropriately captures that an unauthenticated remote attacker can reliably leak confidential data from private networks, though availability and integrity are not compromised.

Frequently asked questions