Mattermost CVE-2026-3472

Authentication is required - the CVSS vector PR:L confirms the attacker must hold a valid Mattermost account with access to a channel where an AI bot integration is active. The AI bot feature (tool result posts) must be enabled and in use within the targeted workspace. Victim interaction is required (UI:R): a specific user must open or render the AI bot tool result post in their client for the outbound image request to trigger. The bypass is specific to AI bot tool result rendering paths - standard user posts remain protected by existing markdown image restrictions. Exploitation is limited to partial data exfiltration via the image request; full session hijacking or code execution are not within scope of this vulnerability.

The CVSS 3.1 base score of 3.5 (Low) accurately reflects the constrained exploitation conditions: the attacker must be authenticated (PR:L), and exploitation requires a victim to render the malicious post in their client (UI:R). Scope is unchanged (S:U) and impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequence. No EPSS data was provided in the source intelligence. The vulnerability is not present in CISA KEV and no public proof-of-concept code has been identified, further constraining realistic exploitation risk. The most significant real-world risk is in organizations where AI bot integrations are actively deployed and where an authenticated insider threat or compromised account could target colleagues who interact with bot output. The practical impact is data exfiltration scoped to what the victim's client leaks in the image request (e.g., cookies, tokens, referrer headers), not full account takeover or lateral movement. Overall, this is a genuine but limited risk, primarily relevant to Mattermost deployments with AI bot features enabled.

An authenticated Mattermost user with access to a channel using an AI bot crafts input that causes the bot's tool result response to include markdown image syntax such as an external URL pointing to an attacker-controlled server. When a target colleague's Mattermost client renders that AI bot tool result post, the client automatically fetches the image URL, sending an HTTP request to the attacker's server that may include session cookies, authentication tokens, or other request metadata embedded by the browser or desktop client. No public proof-of-concept code has been identified, but the technique is well-understood and low-complexity to implement for any authenticated user.