What is the CVSS score of CVE-2026-4339?

CVE-2026-4339 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Mattermost Agents CVE-2026-4339

EUVD-2026-39779 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-26 responsibledisclosure@mattermost.com

GHSA-p3qg-h7r3-79xr

SSRF Mattermost Mattermost Server

6.5

CVSS 3.1 · Vendor: mattermost

Severity by source

Vendor (mattermost) PRIMARY

6.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Local vector because MCP stdio mode is process-local; PR:L as attacker needs interface access; S:C and C:H reflect SSRF reaching internal network services beyond the vulnerable host.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (mattermost).

CVSS VectorVendor: mattermost

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:06 vuln.today

DescriptionCVE.org

Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the Mattermost Agents plugin MCP server which allows an attacker with access to the MCP server in stdio mode to perform server-side request forgery (SSRF) and exfiltrate data from internal network services via supplying internal URLs as file attachments in post creation requests.. Mattermost Advisory ID: MMSA-2026-00635

AnalysisAI

Server-side request forgery in the Mattermost Agents plugin MCP server (stdio mode) allows a low-privileged local attacker to make the server fetch arbitrary internal URLs submitted as file attachment references in post creation requests, enabling exfiltration of data from RFC 1918-addressed services on the internal network. Affected are Mattermost deployments running versions 10.11.x ≤ 10.11.18, 11.5.x ≤ 11.5.6, and 11.6.x ≤ 11.6.3 with the Agents plugin's MCP server active in stdio mode. No public exploit code or CISA KEV listing is present in the available data; exploitation is constrained to attackers who already have local access to the stdio MCP interface.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) describes the root cause: the Mattermost Agents plugin's Model Context Protocol (MCP) server, when operating in stdio mode, performs no validation of URLs supplied as file attachment targets against private or loopback address blocks (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; loopback: 127.0.0.0/8). MCP is a structured protocol allowing AI agents to interact with application services; in stdio mode the server communicates via standard input/output, meaning interaction is inherently local. By supplying an internal URL as a file attachment in a post creation request routed through the MCP server, an attacker causes the server-side HTTP fetch to be issued against internal infrastructure. The affected CPE covers Mattermost platform versions in the 10.11, 11.5, and 11.6 release lines. The missing validation is an egress control gap: there is no allowlist or denylist of resolvable host ranges checked before the outbound request is made.

RemediationAI

The primary remediation is to upgrade Mattermost to the first fixed release in each affected branch, as specified in Mattermost advisory MMSA-2026-00635 at https://mattermost.com/security-updates - exact fix version numbers were not provided in the available data and should be confirmed there before deploying. As an immediate compensating control, disable the Mattermost Agents plugin's MCP server or switch it out of stdio mode if that operational mode is not required; disabling the feature entirely eliminates the attack surface with no impact to core Mattermost functionality. Additionally, enforce network-level egress filtering on the host running Mattermost to block outbound HTTP/S connections to RFC 1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and loopback (127.0.0.0/8); this mitigates SSRF data exfiltration even if the plugin remains active but may break legitimate internal integrations that rely on Mattermost reaching private services. Audit existing MCP server access controls to ensure only trusted processes and identities can interact with the stdio interface.