CVE-2026-72914

Executive Summary

CVE-2026-72914 is an authorization-bypass and resource-exhaustion vulnerability in the Mastodon open-source social network server, affecting the administrative statistics endpoints. Prior to versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController endpoints performed expensive SQL calculations before verifying that the requesting user had administrative privileges. This allows unauthenticated, anonymous callers to submit crafted keys, start_at, and end_at parameters that trigger long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension. By issuing repeated requests, an attacker can exhaust server CPU, memory, and database connection pools, leading to a denial-of-service condition. The CVSS score is 7.5 (High) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. No public exploit code or PoC is currently available, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Technical Analysis

The vulnerability is rooted in a missing authorization check that occurs after, rather than before, expensive computational work begins. The NVD description explicitly names two controllers: Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController. These endpoints are part of Mastodon's administrative statistics interface, designed to provide server admins with metrics on user activity, retention, and other dimensions.

The flaw mechanism is as follows:

1. Request handling: When a request reaches these endpoints, Mastodon's framework begins processing the request immediately. The controller methods in Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController do not gate the entry point with an authorization check (e.g., a before_action callback that validates admin role) at the top of the call chain.

2. Triggering expensive calculations: The controllers delegate to service objects in the Admin::Metrics namespace — specifically Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension. These service classes build and execute SQL queries against the Mastodon database. The attacker-controlled parameters keys, start_at, and end_at are passed into these services. The start_at and end_at parameters define a time range; a wide range (e.g., epoch 0 to current time) forces the database to scan large portions of activity tables. The keys parameter selects which metrics to compute; selecting many or computationally expensive metrics increases query duration.

3. Authorization check deferral: The authorization check (verifying the current user is an admin) is executed only after the metric calculations have been run. This means unauthenticated requests are not rejected at the perimeter; they are processed and cause the database work to happen first.

4. Resource exhaustion: Because the SQL queries are long-running and the endpoint is reachable by anonymous callers, an attacker can issue many concurrent requests, each triggering heavy aggregate queries. The cumulative effect exhausts database connections, CPU cycles, and memory, degrading service for legitimate users. In a worst case, the database service itself may crash or become unresponsive.

A notable secondary concern is that the Admin::Metrics::Dimension::BaseDimension class is used for dimension-type metrics (e.g., breakdowns by user, instance, or software version). These queries may involve GROUP BY operations over large datasets, which are particularly expensive when the time range is not bounded.

This is an authorization-before-use flaw — a classic CWE-405 (Asymmetric Resource Consumption / Amplification) pattern where the cost of servicing a request is not proportional to the requester's privileges.

Exploitation Scenarios

No public PoC or exploit code is currently available. The attack chain below is inferred from the vulnerability class and the specific details provided in the NVD description.

Step 1 — Reconnaissance / target identification: An attacker scans the internet for Mastodon instances. Mastodon servers expose a standard web interface; the administrative API endpoints follow predictable URL patterns (e.g., paths under /api/v1/admin/). The attacker can identify an unpatched instance by version fingerprinting, or simply by probing the endpoints and observing a time-delayed response.

Step 2 — Triggering the flaw: The attacker crafts HTTP requests to the MeasuresController and RetentionController endpoints. The request includes three query parameters: keys, start_at, and end_at. Critically, the attacker does NOT need an authentication token — the vulnerability allows anonymous access. The start_at is set to a very old timestamp (e.g., the epoch of the Mastodon instance's creation or earlier) and end_at is set to the current time, maximizing the data range scanned by the SQL queries. The keys parameter is set to request multiple metrics simultaneously.

Step 3 — Payload / execution at class level: At the vulnerability-class level, this is a resource-exhaustion attack via a missing authorization gate. The "payload" is not malicious code injection; it is a set of valid API parameters chosen to maximize SQL query complexity and duration. The long-running queries are legitimate application logic — the flaw is that this logic runs before the caller's identity is verified.

Step 4 — Post-exploitation / impact: With repeated concurrent requests, the attacker saturates database connections and server resources. The server becomes slow or unresponsive to all users, achieving a denial-of-service state. Because the attack is unauthenticated and requires no special tooling beyond standard HTTP clients (e.g., curl, custom scripts), it can be trivially scaled. There is no data exfiltration impact (confidentiality is unchanged per the CVSS vector), but availability is compromised.

Impact Assessment

The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, yielding a base score of 7.5 (High). Key takeaways from the subscores:

• Attack Vector: Network (AV:N) — the flaw is exploitable remotely over the internet.
• Attack Complexity: Low (AC:L) — no special conditions or race windows are needed.
• Privileges Required: None (PR:N) — the most severe aspect; any anonymous internet user can exploit it.
• User Interaction: None (UI:N) — no social engineering or victim action required.
• Impact: Availability High (A:H), with Confidentiality and Integrity unchanged.

Affected systems: All Mastodon instances running versions prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1. Mastodon is widely deployed across thousands of instances (both small self-hosted servers and larger public instances), making the attack surface broad.

Blast radius: A successful attack degrades or fully disables the affected instance. For small instances, a handful of requests may be enough. For larger instances with many active users, the attacker must sustain a higher request rate, but the amplification is favorable to the attacker — one HTTP request can trigger a multi-second SQL query.

Business impact: For organizations using Mastodon as a public-facing communications platform, an availability outage directly disrupts user engagement, support channels, and public broadcast capabilities. For enterprise deployments where Mastodon is self-hosted, the database server under attack may also host other applications, spreading the impact. The EPSS score of 0.00454 indicates a low likelihood of exploitation in the wild at present, but this can change quickly once a PoC is published.

Detection Guidance

Sigma Rule

The following Sigma rule detects HTTP requests targeting the vulnerable admin metrics endpoints with parameters that suggest a broad time range.

title: Mastodon Admin Metrics API - Unauthenticated Access Attempt
id: 6a9f3e2d-8c41-4f9a-b2a7-3c9f1d7e5a11
status: experimental
description: Detects requests to Mastodon admin metrics endpoints without authentication, which may indicate exploitation of CVE-2026-72914.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-72914
author: Valtersit Threat Intel
date: 2026/02/01
tags:
  - attack.impact
  - attack.t1499
  - cve.2026.72914
logsource:
  category: webserver
  product: nginx
  definition: 'Web server logs for Mastodon instances'
detection:
  selection:
    cs-method: 'GET'
    cs-uri-query|contains:
      - '/api/v1/admin/measures'
      - '/api/v1/admin/retention'
  filter_authenticated:
    cs-username: '*admin*'
  condition: selection and not filter_authenticated
fields:
  - clientip
  - cs-uri-query
  - cs-method
  - cs-useragent
falsepositives:
  - Internal monitoring tools hitting endpoints without auth configured
  - Left-over health check scripts
level: high

YARA Rule

YARA is typically used for file scanning, but can identify exploit scripts or payloads that target this endpoint.

rule Mastodon_CVE_2026_72914_Exploit_Script
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects scripts or tools crafted to exploit Mastodon admin metrics DoS (CVE-2026-72914)"
        date = "2026-02-01"
        cve = "CVE-2026-72914"
    strings:
        $endpoint_measures = "/api/v1/admin/measures" nocase
        $endpoint_retention = "/api/v1/admin/retention" nocase
        $param_keys = "keys=" nocase
        $param_start = "start_at=" nocase
        $param_end = "end_at=" nocase
        $request_header = "requests." ascii
        $loop_concurrent = "threading" ascii
        $loop_threads = "concurrent.futures" ascii
    condition:
        any of ($endpoint_*) and any of ($param_*) and ($request_header or $loop_concurrent or $loop_threads) and filesize < 2MB
}

Suricata IDS Rule

The following Suricata rule triggers on unauthenticated requests to the vulnerable endpoints with suspicious timestamp ranges.

alert http any any -> any any (msg:"ET WEB_SERVER Mastodon Admin Metrics Unauthenticated Access (CVE-2026-72914)"; flow:established,to_server; http.uri; content:"/api/v1/admin/measures"; http.uri; content:"start_at"; http.uri; content:"end_at"; http.uri; content:"keys"; http.method; content:"GET"; threshold:type both, track by_src, count 10, seconds 60; reference:cve,2026-72914; classtype:attempted-dos; sid:2026072914; rev:1;)

alert http any any -> any any (msg:"ET WEB_SERVER Mastodon Admin Retention Endpoint Abuse (CVE-2026-72914)";
 flow:established,to_server; http.uri; content:"/api/v1/admin/retention"; http.uri; content:"start_at"; http.uri; content:"end_at";
 http.method; content:"GET"; threshold:type both, track by_src, count 5, seconds 30;
 reference:cve,2026-72914; classtype:attempted-dos; sid:2026072915; rev:1;)

Elastic Detection

Elastic EQL query to detect repeated request attempts to the vulnerable endpoints from a single source.

sequence by source.ip with maxspan=5m
  [ any where uri.path like "*/api/v1/admin/measures*" ]
  [ any where uri.path like "*/api/v1/admin/retention*" ]
  [ any where uri.path like "*/api/v1/admin/measures*" and event.duration > 5000 ]

Alternatively, a simpler EQL rule for standalone events:

any where
  (uri.path like "*/api/v1/admin/measures*" or uri.path like "*/api/v1/admin/retention*")
  and not user.name like "*admin*"
  and http.response.status_code == 200

Splunk SPL Query

Search for unauthenticated access to the metrics endpoints using Splunk (assuming Apache/nginx access logs are indexed).

index=webserver sourcetype=access_combined
| where match(uri_path, ".*/api/v1/admin/(measures|retention).*")
| eval is_authenticated = if(match(user, "(?i)admin|oauth_token"), "yes", "no")
| where is_authenticated == "no"
| stats count by clientip, uri_path, _time
| where count > 10
| table _time, clientip, uri_path, count
| sort - count

Wazuh OSSEC Rule

Wazuh XML rule to alert on multiple requests to the admin metrics endpoints from the same IP.

<group name="mastodon, cve-2026-72914,">
  <rule id="100914" level="10" frequency="15" timeframe="60">
    <if_sid>30200</if_sid>
    <match>/api/v1/admin/measures|/api/v1/admin/retention</match>
    <description>Mastodon: Multiple unauthenticated requests to admin metrics endpoints - possible DoS attempt (CVE-2026-72914)</description>
    <group>attack.impact,</group>
    <info type="cve">2026-72914</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Despite the NVD description stating fixed versions exist (4.4.21, 4.5.14, 4.6.4, 4.7.0-beta.1), no patch evidence has been confirmed by tracked sources. Administrators should treat this as actively exploitable until verified patches are deployed.

Immediate mitigations (do these now):

1. Enforce authentication at the proxy layer: Configure the reverse proxy (nginx or Apache) fronting Mastodon to require authentication for any request path matching /api/v1/admin/. This blocks unauthenticated traffic before it reaches the application. In nginx, add a return 401; directive in a location block for /api/v1/admin/.
2. Rate-limit the admin endpoints: Apply strict rate limiting at the proxy for requests to /api/v1/admin/ paths. Limit to a low number of requests per minute per IP. This does not stop the attack but reduces the amplification factor.
3. Block anonymous access via firewall: If Mastodon is internal-only, restrict access to the /api/v1/admin/ path by IP allow-list at the firewall.
4. Monitor database load: Set up alerting on database query time and connection pool saturation; this aids early detection during an attack.

Patch/upgrade steps:

5. Verify and apply the vendor patch. The canonical fix is upgrading to one of: 4.4.21, 4.5.14, 4.6.4, or 4.7.0-beta.1 (or later). The fix implementation moves the authorization check to a before_action at the top of the controller call chain, ensuring the admin role is verified before any metric calculations. Since patch confidence is low, validate the upgrade by testing the endpoints with an unauthenticated request and confirming a 401 Unauthorized or 403 Forbidden response is returned immediately with no database work.
6. Until the patch is confirmed, keep the proxy-level authentication enforcement in place even after upgrading, as a defense-in-depth measure.

Long-term hardening:

7. Conduct a code review of any custom controllers/service classes to ensure authorization checks are always the first action in the request lifecycle.
8. Implement overall request size limits and query-timeout thresholds in the database layer (e.g., PostgreSQL statement_timeout) to cap the duration of any single query.
9. Add the vulnerable endpoint patterns to the organization's WAF rules and IDS signatures (see detection guidance).
10. Subscribe to Mastodon security advisories and enable automatic patch notifications for instances managed via standard package managers.

References

1. NVD Entry: CVE-2026-72914 — NVD Description and CVSS vector.
2. Mastodon Security Advisories: https://github.com/mastodon/mastodon (connection failed — verify manually)/security/advisories — Vendor advisory page (check for advisory related to CVE-2026-72914).
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Verified: CVE-2026-72914 is NOT listed in the KEV catalog as of this report.
4. FIRST EPSS: https://www.first.org/epss/ — EPSS score 0.00454 (37.4th percentile).
5. CWE-405: https://cwe.mitre.org/data/definitions/405.html — Asymmetric Resource Consumption (Amplification) weakness description.

No known threat actor campaigns have been identified exploiting this CVE in the wild, and no exploit code or PoC has been published. The EPSS percentile (37.4%) indicates exploitation is plausible but not currently widespread.