PT-2026-25758 · Mattermost · Mattermost

Winfunc

·

Published

2026-02-13

·

Updated

2026-03-27

·

CVE-2026-2455

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.10 Mattermost versions 11.2.x through 11.2.2 Mattermost versions 11.3.x through 11.3.0
Description The software does not properly normalize IPv4-mapped IPv6 addresses before validating reserved IP addresses. This allows an attacker to perform Server-Side Request Forgery (SSRF) attacks against internal services using IPv4-mapped IPv6 literals, such as [::ffff:127.0.0.1]. SSRF is a web security flaw that allows an attacker to cause the server to make HTTP requests to an arbitrary domain of the attacker's choosing.
Recommendations Update Mattermost to a version beyond 10.11.10. Update Mattermost to a version beyond 11.2.2. Update Mattermost to a version beyond 11.3.0.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2026-06560
CVE-2026-2455
GHSA-GQV7-J2J8-QMWQ
GO-2026-4746
SUSE-SU-2026:1135-1

Affected Products

Mattermost