The vulnerability is caused by an incomplete blacklist of private IP ranges in Mastodon's outbound request validation. This allows an attacker to provide an IP address that lies within the omitted ranges, causing the server to send HTTP requests to loopback or local network hosts. As a result, internal services or sensitive resources that are normally inaccessible from the public network could be queried by the attacker, enabling data exfiltration or further lateral movement. The weakness belongs to CWE‑918, which characterises Server‑Side Request Forgery where the target of an outbound request is not properly validated.

The defect affects all Mastodon installations using versions that precede the published fixes: 4.5.4, 4.4.11, 4.3.17 and 4.2.29. Systems running earlier patch levels and not manually excluded certain private IP ranges are susceptible. Other platforms that incorporate the same outbound request logic without the updated whitelist are likely affected as well.

Mastodon assigns a CVSS score of 7.1, classifying the issue as High severity. The EPSS score is below 1 %, indicating a very low but non‑zero probability of exploitation in the near term, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The SSRF attack vector requires the attacker to supply a crafted IP address that falls within the omitted private ranges, after which Mastodon will perform the outbound request. Successful exploitation can expose internal hosts or services which are normally protected, and depending on the internal network design, could be leveraged for further compromise. Given the low exploitation probability but significant potential impact, administrators should consider applying the available fixes promptly.