CVE-2026-59825

Published: Aug 18, 2026Modified: Aug 18, 2026

7.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.2 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq background jobs remain unaffected. This issue is fixed in versions 4.4.19 and 4.5.12.

Related CWEs

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (7)

https://github.com/mastodon/mastodon/commit/2ccb6ef277e725d1932295690cf8ab9d3dc03149

Source: security-advisories@github.com

https://github.com/mastodon/mastodon/commit/5748d0b16ea09001e0933f76c7afe814e09652ef

Source: security-advisories@github.com

https://github.com/mastodon/mastodon/commit/761c61b42590a2fd91442fc15a0a7583e48bbea4

Source: security-advisories@github.com

https://github.com/mastodon/mastodon/pull/39571

Source: security-advisories@github.com

https://github.com/mastodon/mastodon/releases/tag/v4.4.19

Source: security-advisories@github.com

https://github.com/mastodon/mastodon/releases/tag/v4.5.12

Source: security-advisories@github.com

https://github.com/mastodon/mastodon/security/advisories/GHSA-3rhr-8phh-jm86

Source: security-advisories@github.com

Timeline

No history available yet.