Mattermost CVE-2026-3108

Attacker must post crafted messages containing ANSI/OSC escape sequences in Mattermost channels. Administrator must execute mmctl commands that display the attacker's post in terminal output, viewing the malicious content which triggers screen manipulation, fake prompts, or clipboard hijacking. Affects Mattermost 11.2.x ≤11.2.2, 10.11.x ≤10.11.10, 11.4.x ≤11.4.0, 11.3.x ≤11.3.1.

The CVSS score of 8.0 (High) reflects significant potential impact with CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, indicating network-based attack with high complexity, requiring low-privilege authenticated access and user interaction, but enabling scope change with high confidentiality, integrity, and availability impact. CISA SSVC framework rates this as exploitation: none, automatable: no, technical impact: total, which tempers immediate urgency since no public exploit is identified at time of analysis and automation is not feasible. Attack complexity is high (AC:H) because successful exploitation depends on administrators actively running mmctl commands against attacker-controlled content and falling victim to social engineering when presented with manipulated terminal output. Scope change (S:C) elevates risk as terminal compromise can lead to actions beyond the Mattermost application context. While CVSS suggests high severity, real-world exploitability is constrained by the requirement for administrator interaction with specific CLI tooling and the sophistication needed to craft convincing fake prompts. This represents a genuine but operationally limited risk, prioritized for environments where mmctl is heavily used by administrators.

An authenticated attacker with low privileges creates a Mattermost post containing carefully crafted ANSI escape sequences designed to clear the terminal screen and display a fake shell prompt requesting credentials or suggesting a malicious command. When a system administrator runs mmctl to export channel messages or search posts for investigation purposes, the malicious sequences execute in their terminal, displaying what appears to be a legitimate system prompt asking for password re-authentication or suggesting a command to fix a spurious error. If the administrator enters credentials or executes the suggested command, the attacker achieves credential theft or code execution in the administrator's security context.