What is the CVSS score of CVE-2026-3472?

CVE-2026-3472 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Mattermost CVE-2026-3472

Q: Which versions of Mattermost are affected by CVE-2026-3472?

Markdown image rendering restrictions in Mattermost are bypassed specifically for AI bot tool result posts, enabling authenticated attackers to exfiltrate data to attacker-controlled infrastructure.

EUVD-2026-39775 LOW

Protection Mechanism Failure (CWE-693)

2026-06-26 responsibledisclosure@mattermost.com

GHSA-8rm3-f79m-54wg

Code Injection Mattermost Mattermost Server

3.5

CVSS 3.1 · Vendor: mattermost

Severity by source

Vendor (mattermost) PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.5 LOW

Attacker must be authenticated (PR:L) and victim must render the post (UI:R); impact is limited to partial data exfiltration with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mattermost).

CVSS VectorVendor: mattermost

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:05 vuln.today

DescriptionCVE.org

Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to properly apply markdown image rendering restrictions to AI bot tool result posts, which allows an authenticated attacker to exfiltrate data to an attacker-controlled server via injecting markdown image syntax into tool result content rendered by a victim's client.. Mattermost Advisory ID: MMSA-2026-00619

AnalysisAI

Markdown image rendering restrictions in Mattermost are bypassed specifically for AI bot tool result posts, enabling authenticated attackers to exfiltrate data to attacker-controlled infrastructure. Affected are Mattermost versions 10.11.x through 10.11.18, 11.5.x through 11.5.6, and 11.6.x through 11.6.3. When a victim's client renders an AI bot tool result post containing injected markdown image syntax, the client issues an outbound request to the attacker's server, leaking request metadata such as session tokens or channel context. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Mattermost is a self-hosted team collaboration platform that supports AI bot integrations capable of returning structured tool results rendered in the client UI. The platform enforces markdown image rendering restrictions to prevent server-side request forgery and data exfiltration via rendered image tags - a known attack class in chat platforms. CWE-693 (Protection Mechanism Failure) describes the root cause: the restriction is implemented but not uniformly applied across all post types. Specifically, AI bot tool result posts are processed through a separate rendering path that does not enforce the same markdown image policy as standard user posts, creating a bypass condition. The attack exploits the client-side rendering behavior where image URLs are fetched automatically by the victim's browser or desktop client upon post display.

RemediationAI

Upgrade Mattermost to a version beyond the affected ranges (above 10.11.18, 11.5.6, or 11.6.3 respectively). The exact patched release versions are not independently confirmed from the available data - consult the vendor security page at https://mattermost.com/security-updates for the specific fixed builds. As a compensating control pending upgrade, administrators can disable or restrict AI bot tool integrations to reduce the attack surface, accepting the trade-off of reduced AI functionality. Restricting the set of authenticated users who can interact with AI bots also limits the pool of potential attackers. Client-side network egress filtering to block unexpected outbound image requests from Mattermost clients may reduce exfiltration effectiveness but is complex to implement without false positives.