Mattermost CVE-2026-24458

Mattermost versions 11.3.0 or earlier, 11.2.2 or earlier, or 10.11.10 or earlier with publicly accessible login endpoint. No authentication required; default configurations vulnerable to remote unauthenticated attackers.

This vulnerability presents a moderate-to-high real-world risk based on multiple factors. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates it's remotely exploitable with low complexity and requires no privileges or user interaction, making it trivially exploitable. However, the impact is limited to availability (A:H) with no confidentiality or integrity impact. The vulnerability is not listed in CISA KEV, suggesting no known active exploitation in the wild. Without EPSS data provided, we cannot assess the statistical likelihood of exploitation. The attack is highly automatable and could be weaponized for distributed denial-of-service campaigns against internet-facing Mattermost instances, making this a priority for organizations running exposed servers.

An attacker identifies an internet-facing Mattermost server and crafts malicious login requests containing passwords of several megabytes in size. By automating these requests from multiple sources or in rapid succession, the attacker forces the server to allocate significant CPU cycles and memory to process each oversized password through the authentication system, eventually exhausting server resources and causing legitimate users to experience service outages or degraded performance.