CVE-2026-72916 Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses
Attackers can bypass SSRF protections using IPv4-compatible IPv6 addresses to access private resources on loopback interfaces.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72916?
CVE-2026-72916 is a medium-severity server-side request forgery vulnerability in mastodon, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/lib/private_address_check.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. An attacker could supply an address in the omitted range to bypass the ALLOWED_PRIVATE_ADDRESSES protection and make Mastodon send HTTP requests to loopback interfaces, potentially accessing private resources and services. Exploitation requires a system that supports the obsolete IPv4-compatible IPv6 mechanism. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.
Which versions are affected by CVE-2026-72916?
1 open source package ship an affected version, including mastodon.
| Package | Affected | Fixed in |
|---|---|---|
mastodon Bitnami | All versions | 4.4.21, 4.5.14, 4.6.4 |
How do I fix CVE-2026-72916?
Upgrade mastodon to a fixed version for your release line: 4.4.21, 4.5.14 or 4.6.4.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-72916 being exploited?
There is no known exploitation of CVE-2026-72916 in the wild and no public exploit code.
Sources
Also known as BIT-mastodon-2026-72916, GHSA-vwhj-3g83-v276.