Mastodon servers that are older than 4.5.10, 4.4.17, or 4.3.23 contain a missing exclusion of the IPv6 unspecified address (::) from the list of disallowed IP ranges. This omission lets an attacker craft a request that forces Mastodon to resolve the address to the local loopback interface and then perform an HTTP request to that address. Because the request originates from the server, it can reach internal services or resources that are normally inaccessible from the outside, potentially exposing sensitive data or enabling further attacks. The flaw is formally categorized as CWE‑918, reflecting an SSRF vulnerability.

The affected product is the Mastodon open‑source social network server. Versions prior to 4.5.10, 4.4.17, or 4.3.23 are vulnerable. The problem arises from the server’s IP filtering logic, not from any specific deployment setup, but it affects all installations running those legacy versions.

The CVSS score is 8.7, indicating high severity. EPSS data is currently unavailable and the flaw is not listed in the CISA KEV catalog, so the current exploit probability is unknown. Based on the description, the likely attack vector is that an attacker only needs to send an HTTP request with the IPv6 unspecified address to the vulnerable Mastodon instance, which will then forward the request to the loopback interface. If the target contains internal services or privileged data, the attacker can read or manipulate them. Because the vulnerability allows arbitrary outbound request initiation, the potential impact on confidentiality, integrity, and availability is significant for systems that rely on network isolation.