Mastodon has SSRF Protection bypass(CVE-2026-22245)

概要

Mastodon has SSRF Protection bypass

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow requests to local IP addresses (unless specified in ALLOWED_PRIVATE_ADDRESSES) to avoid the "confused deputy" problem. The list of disallowed IP address ranges was lacking some IP address ranges that can be used to reach local IP addresses. An attacker can use an IP address in the affected ranges to make Mastodon perform HTTP requests against loopback or local network hosts, potentially allowing access to otherwise private resources and services. This is fixed in Mastodon v4.5.4, v4.4.11, v4.3.17 and v4.2.29.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami mastodon

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.29"},{"introduced":"4.3.0"},{"fixed":"4.3.17"},{"introduced":"4.4.0"},{"fixed":"4.4.11"},{"introduced":"4.5.0"},{"fixed":"4.5.4"}]}]

参照URL

advisory github.com
patch github.com
patch github.com
patch github.com
web nvd.nist.gov