EUVD-2026-31646
GHSA-5gmf-x7hg-97wf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry.. Mattermost Advisory ID: MMSA-2026-00641
AnalysisAI
Server process termination in Mattermost is achievable by any authenticated user via a crafted outgoing webhook callback response that contains a null attachment entry - exploiting the server's failure to filter nil elements from attachment payloads before processing (CWE-754). Affected release trains span 10.11.x through 11.6.x, covering a wide installed base. No public exploit exists and EPSS is extremely low at 0.04% (12th percentile), but the availability impact is rated High by CVSS and the attack requires only low-privilege authentication over the network with no user interaction, making this a meaningful insider or compromised-account threat capable of triggering a full service outage.
Technical ContextAI
Mattermost is an open-source team messaging platform written primarily in Go. Its outgoing webhook feature allows channels to POST data to external URLs and process the returned payloads. The root cause is CWE-754 (Improper Check for Unusual or Exceptional Conditions): the server-side attachment payload processing pipeline does not validate or filter nil elements from the webhook callback response's attachment array before iterating over it. In Go, dereferencing a nil pointer or ranging over a structure containing nil elements without guards causes a runtime panic, which terminates the server process. CPE cpe:2.3:a:mattermost:mattermost applies broadly across versions. The vulnerability is specific to the outgoing webhook attachment handling code path, not the broader messaging or API surface.
RemediationAI
Upgrade Mattermost to a fixed release above the affected version ceilings for each supported branch: the next release above 10.11.14 in the 10.11.x train, above 11.4.4 in the 11.4.x train, above 11.5.3 in the 11.5.x train, and above 11.6.0 in the 11.6.x train. Exact patched version numbers are not explicitly enumerated in the available data and should be confirmed directly at https://mattermost.com/security-updates (MMSA-2026-00641). If immediate patching is not possible, a compensating control is to restrict or disable the outgoing webhooks feature via the System Console (Site Configuration > Integrations > Enable Outgoing Webhooks), which eliminates the vulnerable code path entirely; however, this disables all outgoing webhook integrations and may impact automation workflows. Alternatively, restrict outgoing webhook creation to trusted, highly privileged roles only, reducing the pool of users who can trigger the vulnerable path. Network-layer blocking of the webhook callback port does not fully mitigate the issue, as the null payload can be delivered by any server the webhook is pointed to.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today