Mattermost Agents CVE-2026-4339

Exploitation requires three specific conditions to be simultaneously true: (1) the Mattermost Agents plugin must be installed and active; (2) the MCP server within that plugin must be running in stdio mode specifically - other MCP transport modes are not indicated as vulnerable; and (3) the attacker must have low-privilege local access to the process interface of that MCP server (CVSS PR:L, AV:L). The CVSS local attack vector confirms this is not a remotely reachable endpoint over the network in a default Mattermost deployment. What limits exploitation: attackers without pre-existing local host access or MCP stdio interface access cannot exploit this remotely; integrity and availability are unaffected (I:N, A:N); and environments that do not deploy the Agents plugin at all have no exposure.

The NVD CVSS 3.1 score of 6.5 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N correctly reflects a local-vector attack with scope change and high confidentiality impact. The S:C and C:H metrics are the headline risk: a successful exploit reaches internal network services beyond the Mattermost host itself, potentially exposing cloud metadata endpoints, internal APIs, or databases. However, AV:L fundamentally limits the threat surface - the attacker must already have local access to the process running the MCP server in stdio mode, which in practice means a compromised host or a malicious or colluding user/process co-located with the Mattermost agent runtime. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. There is no CISA KEV listing and no confirmed POC. The SSRF vector and S:C scope change elevate theoretical damage potential, but the local prerequisite significantly reduces the realistic attacker population compared to a network-vector SSRF. Priority should be moderate: patch promptly in environments where the Agents plugin is deployed, but this does not represent an emergency for organizations not using the plugin or MCP stdio mode.

An attacker with local access to the host running the Mattermost Agents plugin in MCP stdio mode crafts a post creation request that includes an internal URL - such as http://169.254.169.254/latest/meta-data/ (cloud instance metadata) or http://192.168.1.10:8080/api/internal - as a file attachment reference. The Agents plugin MCP server issues an outbound HTTP fetch to the supplied URL without checking it against blocked address ranges, and the response body (containing cloud credentials or internal API responses) is returned or logged in a manner accessible to the attacker. No interaction from other users or administrators is required beyond the attacker's existing local access.