CVE-2026-46349: Mastodon

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing attackers to re-arrange a valid signed JSON-LD activity from a third-party actor to have it processed differently. This vulnerability is fixed in 4.5.10, 4.4.17, and 4.3.23.

Affected products

• Mastodon Mastodon: from 4.5.0-beta.1, before 4.5.10 (fixed in 4.5.10)

Published 2026-06-24. Last modified 2026-06-25.