cvesecurityvulnerability
CVE-2026-72916: Mastodon SSRF Bypass via IPv4-Compatible IPv6 Addresses
Mastodon's SSRF protection blocklist omitted IPv4-compatible IPv6 addresses, letting attackers reach loopback and cloud metadata endpoints. Fixed in 4.4.21, 4.5.14, and 4.6.4.
