CVE-2026-25540
Web Cache Poisoning in Mastodon ActivityPub Endpoints
Publication date: 2026-02-04
Last updated on: 2026-02-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| joinmastodon | mastodon | to 4.3.19 (exc) |
| joinmastodon | mastodon | From 4.4.0 (inc) to 4.4.13 (exc) |
| joinmastodon | mastodon | From 4.5.0 (inc) to 4.5.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-524 | The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Mastodon, an open-source social network server. Before certain fixed versions, Mastodon’s caching mechanism for ActivityPub endpoints could serve cached content based on the account that signed the HTTP request without properly isolating cache entries per user. Specifically, when AUTHORIZED_FETCH is enabled, responses for pinned posts and featured hashtags depend on the requesting account, but the cache does not differentiate between different users.
As a result, cached responses intended for one user (such as an empty response for a blocked user) could be served to other users (including legitimate non-blocked users), or vice versa. This is known as web cache poisoning and can cause incorrect or unintended content to be delivered to users.
How can this vulnerability impact me? :
This vulnerability can lead to users receiving incorrect or unintended content. For example, a legitimate user might receive an empty response if the cache was poisoned by a blocked user's request, or a blocked user might see content meant only for non-blocked users.
Such behavior can cause confusion, degrade user experience, and potentially expose information inconsistently. It may also undermine trust in the platform's content delivery and user access controls.
The vulnerability has a CVSS base score of 6.5, indicating a medium severity with impacts on confidentiality and availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Mastodon to one of the patched versions: 4.3.19, 4.4.13, or 4.5.6.