CVE-2026-59825CWE-295

CVE-2026-59825

High · published August 18, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq background jobs remain unaffected. This issue is fixed in versions 4.4.19 and 4.5.12.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00373 · 30.0th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-08-18T19:16Z
References (7)
https://github.com/mastodon/mastodon/commit/2ccb6ef277e725d1932295690cf8ab9d3dc03149 · [email protected]https://github.com/mastodon/mastodon/commit/5748d0b16ea09001e0933f76c7afe814e09652ef · [email protected]https://github.com/mastodon/mastodon/commit/761c61b42590a2fd91442fc15a0a7583e48bbea4 · [email protected]https://github.com/mastodon/mastodon/pull/39571 · [email protected]https://github.com/mastodon/mastodon/releases/tag/v4.4.19 · [email protected]https://github.com/mastodon/mastodon/releases/tag/v4.5.12 · [email protected]https://github.com/mastodon/mastodon/security/advisories/GHSA-3rhr-8phh-jm86 · [email protected]
EPSS history
Timeline
  • 18 AUG 15:07Z
    Mastodon: Unwanted deactivation of SSL/TLS certificate verification
    cvelistv5