CVE-2026-46713

CVE-2026-46713 is a JSON-LD signature validation flaw in Misskey that allows spoofing federated activities. The CVSS 9.2 rating is accurate in terms of potential severity, but the EPSS score of 0.00174 is misleading — not because the vulnerability is theoretical, but because exploitation requires running a hostile Fediverse server and understanding JSON-LD compaction edge cases. The attacker population is specialized, not absent. The critical distinction this CVE doesn't make explicit:spoofing different activity types has wildly different blast radii. A spoofed 'Like' pollutes engagement metrics. A spoofed 'Follow' or 'Block' restructures the social graph — and graph-modifying activities propagate farthest because recommendation systems, delivery logic, and trust calculations across the Fediverse treat them as authoritative inputs. This is where the real damage lives, and it's what a flat CVSS score obscures. More concerning than the vulnerability itself is the propagation pathway. If your Misskey instance relays content to other servers — and mid-tier relay nodes do — then accepting a spoofed activity doesn't stay local. It poisons the trust graph that downstream instances depend on. Check your instance's relay configuration: if you're relaying, your patching timeline affects not just your users but every server receiving your federated content. Action items: verify you're running 2026.5.4 or later; audit your inbox for activities with anomalous signature patterns (particularly Follow/Block operations from actors you've never directly federated with); if you operate a relay node, prioritize this patch aggressively because your instance is a force multiplier for whatever gets through. The fix addresses this specific flaw, but the JSON-LD signature verification class of vulnerability likely exists in other ActivityPub implementations that haven't received equivalent scrutiny — treat this as a canary.

Reviewed through automated stages and approved by a human before publication.