Is CVE-2026-59825 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-59825?

CVE-2026-59825 has a CVSS v3 severity of HIGH (7.4).

Back

CVE-2026-59825

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq background jobs remain unaffected. This issue is fixed in versions 4.4.19 and 4.5.12.