PT-2026-41656 · Mattermost · Mattermost

Juho Forsén · Published 2026-05-18 · Updated 2026-05-18 · CVE-2026-6333

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13

Description An issue exists where the software fails to validate the Host header when constructing response URLs for custom slash commands. This allows an authenticated attacker to redirect slash command responses to a server under their control by using a spoofed Host header.

Recommendations Update Mattermost versions 11.5.0 through 11.5.1 to a version later than 11.5.1. Update Mattermost versions 10.11.0 through 10.11.13 to a version later than 10.11.13.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-6333

GHSA-VQP5-2MRP-QQXG

Affected Products

Mattermost

References · 9

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vqp5-2mrp-qqxg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6333 · Security Note
• https://github.com/mattermost/mattermost/commit/e738016c592045e14bf926eafaeda6f8521def6d · Note
• https://github.com/mattermost/mattermost · Note
• https://twitter.com/CVEarity/status/2056409635725496438 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6333 · Note
• https://t.me/CVEtracker/54116 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2056338231226970481 · Twitter Post