PT-2026-41656 · Mattermost · Mattermost

Juho Forsén · CVE-2026-6333 · Published 2026-05-18 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13

Description An issue exists where the software fails to validate the Host header when constructing response URLs for custom slash commands. This allows an authenticated attacker to redirect slash command responses to a server under their control by using a spoofed Host header.

Recommendations Update Mattermost versions 11.5.0 through 11.5.1 to a version later than 11.5.1. Update Mattermost versions 10.11.0 through 10.11.13 to a version later than 10.11.13.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-6333

GHSA-VQP5-2MRP-QQXG

GO-2026-5671

Affected Products

Mattermost

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6333.json · Exploit
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vqp5-2mrp-qqxg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-6333 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5671 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6333 · Security Note
• https://github.com/mattermost/mattermost/commit/e738016c592045e14bf926eafaeda6f8521def6d · Note
• https://github.com/mattermost/mattermost · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6333 · Note
• https://t.me/CVEtracker/54116 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2056338231226970481 · Twitter Post
• https://github.com/advisories/GHSA-vqp5-2mrp-qqxg · Note
• https://twitter.com/CVEarity/status/2056409635725496438 · Twitter Post