What is the CVSS score of CVE-2026-3108?

CVE-2026-3108 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by CVE-2026-3108?

Mattermost's mmctl administration tool contains an escape sequence injection vulnerability that allows authenticated users to manipulate terminal displays and inject fake prompts when administrators…. A patch is available.

How to fix or mitigate CVE-2026-3108?

Within 24 hours: Identify all administrators with mmctl access and restrict command-line message export/query operations to isolated terminals without external access. Within 7 days: Document all mmctl usage and implement mandatory terminal safety training for administrators emphasizing verification of command sources before execution. Within 30 days: Monitor Mattermost security advisories for patch availability; evaluate alternative administration workflows that do not require mmctl until a vendor patch is released.

Mattermost CVE-2026-3108

EUVD-2026-16234 HIGH

Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)

2026-03-26 Mattermost

GHSA-3439-vqgj-2gcf

Information Disclosure Mattermost

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16234

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:16 nvd

HIGH 8.0

DescriptionCVE.org

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking.. Mattermost Advisory ID: MMSA-2026-00599

AnalysisAI

Mattermost's mmctl command-line administration tool fails to sanitize ANSI and OSC escape sequences embedded in user-generated post content, enabling authenticated low-privilege attackers to inject malicious terminal control codes when administrators export or query messages. Exploitation allows screen manipulation, fake prompt injection, and clipboard hijacking against administrators running mmctl commands, potentially leading to secondary code execution if administrators are tricked into running injected commands. CISA SSVC framework indicates no current exploitation, non-automatable attack requiring high complexity and user interaction, but with total technical impact potential.

Technical ContextAI

This vulnerability affects the mmctl command-line tool within Mattermost server deployments (CPE: cpe:2.3:a:mattermost:mattermost). The root cause is CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences), where mmctl fails to strip or encode ANSI escape sequences (used for terminal formatting like colors and cursor positioning) and OSC (Operating System Command) sequences when rendering post content to administrator terminals. When mmctl retrieves message data containing attacker-crafted escape sequences, these codes are passed directly to the terminal emulator, which interprets them as legitimate control commands rather than display text. This allows attackers to manipulate the visual output of the terminal, insert fake command prompts that appear legitimate, or use OSC 52 sequences to read/write clipboard contents on certain terminal emulators.

RemediationAI

Upgrade to Mattermost versions beyond 11.4.0, 11.3.1, 11.2.2, or 10.11.10 respectively for each affected branch once patched releases become available per vendor advisory at https://mattermost.com/security-updates. Until patching is completed, administrators should exercise caution when using mmctl to query or export post content from channels accessible to untrusted users, avoid copying terminal output directly into clipboard or executing commands suggested by terminal prompts without verification, and consider using mmctl in isolated environments with output redirected to files for sanitized review. Organizations may implement wrapper scripts that filter ANSI/OSC sequences from mmctl output using tools like sed or ansi2txt before display. Review administrator workflows to minimize mmctl usage against user-generated content channels and restrict mmctl access to trusted operators only.