PT-2026-41660 · Mattermost · Mattermost

Published 2026-05-18 · Updated 2026-05-18 · CVE-2026-6346

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13 Mattermost versions 11.4.0 through 11.4.3

Description Sensitive configuration fields are not properly sanitized before being included in support packet generation. This allows a System Admin or any party with access to a support packet to obtain sensitive credentials in plaintext by downloading a support packet from the System Console.

Recommendations Update Mattermost versions 11.5.0 through 11.5.1 to a version newer than 11.5.1. Update Mattermost versions 10.11.0 through 10.11.13 to a version newer than 10.11.13. Update Mattermost versions 11.4.0 through 11.4.3 to a version newer than 11.4.3.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-6346

GHSA-9P64-JPC7-M2RP

Affected Products

Mattermost

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-6346 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9p64-jpc7-m2rp · Vendor Advisory
• https://github.com/mattermost/mattermost/commit/fac92f4a71f356009e27983a980f729f599e8ba5 · Note
• https://github.com/mattermost/mattermost · Note
• https://t.me/CVEtracker/54120 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6346 · Note
• https://twitter.com/CVEarity/status/2056408545084792968 · Twitter Post