CVE-2026-72916

Received Received - Intake

IPv6 Address Bypass in Mastodon

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/lib/private_address_check.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. An attacker could supply an address in the omitted range to bypass the ALLOWED_PRIVATE_ADDRESSES protection and make Mastodon send HTTP requests to loopback interfaces, potentially accessing private resources and services. Exploitation requires a system that supports the obsolete IPv4-compatible IPv6 mechanism. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72916

Affected Vendors & Products

Vendor	Product	Version / Range
mastodon	mastodon	to 4.4.21 (inc)
mastodon	mastodon	to 4.5.14 (inc)
mastodon	mastodon	to 4.6.4 (inc)
mastodon	mastodon	to 4.7.0-beta.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-1286	The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

Attack-Flow Graph

Executive Summary

This vulnerability in Mastodon versions before 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 involves a flaw in the PrivateAddressCheck component. It fails to properly recognize IPv4-compatible IPv6 addresses, allowing attackers to bypass IP address restrictions. By using an obsolete IPv4-compatible IPv6 format, an attacker could trick Mastodon into sending HTTP requests to internal loopback interfaces, potentially accessing private services or resources.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to internal services running on your Mastodon server. Attackers might interact with private APIs, databases, or other services that should be restricted. This could lead to data leaks, service disruption, or further compromise of your infrastructure, depending on what internal services are exposed.

Compliance Impact

This vulnerability could impact compliance by potentially exposing sensitive data to unauthorized parties. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. If exploited, unauthorized access to internal resources might lead to data breaches, resulting in regulatory penalties, fines, or reputational damage for failing to maintain adequate security controls.

Mitigation Strategies

Upgrade Mastodon to versions 4.4.21, 4.5.14, 4.6.4, or 4.7.0-beta.1 or later to address the IPv4-compatible IPv6 address bypass in PrivateAddressCheck.

Hi! I’m here to help you understand CVE-2026-72916. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70