PT-2026-25758 · Mattermost · Mattermost

Winfunc

·

Publicado

2026-02-13

·

Atualizado

2026-03-27

·

CVE-2026-2455

CVSS v3.1

4.3

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.10 Mattermost versions 11.2.x through 11.2.2 Mattermost versions 11.3.x through 11.3.0
Description The software does not properly normalize IPv4-mapped IPv6 addresses before validating reserved IP addresses. This allows an attacker to perform Server-Side Request Forgery (SSRF) attacks against internal services using IPv4-mapped IPv6 literals, such as [::ffff:127.0.0.1]. SSRF is a web security flaw that allows an attacker to cause the server to make HTTP requests to an arbitrary domain of the attacker's choosing.
Recommendations Update Mattermost to a version beyond 10.11.10. Update Mattermost to a version beyond 11.2.2. Update Mattermost to a version beyond 11.3.0.

Correção

SSRF

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BDU:2026-06560
CVE-2026-2455
GHSA-GQV7-J2J8-QMWQ
GO-2026-4746
SUSE-SU-2026:1135-1

Produtos afetados

Mattermost