Mattermost CVE-2026-5308

Exploitation requires that the target Mattermost server exposes plugin HTTP endpoints and that the attacker can send HTTP requests to them; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, and the attack works over the network against affected default builds. The concrete prerequisite is a reachable plugin HTTP endpoint on an affected version (11.6.0, ≤11.5.3, ≤11.4.4, or ≤10.11.14) that lacks the request body size limit. Limiting factors that reduce real-world risk: the impact is availability-only (no code execution or data access), an upstream proxy that already enforces body-size/rate limits can blunt or prevent the attack, and servers not exposed to untrusted networks have a much smaller attack surface.

The signals are consistent but point to a moderate, availability-only risk rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) indicates a remotely reachable, low-complexity, unauthenticated attack, but with impact confined to availability (C:N/I:N/A:H). EPSS is very low (0.04%, 11th percentile) and CISA SSVC scores Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial' - meaning no known active exploitation and no evidence of scalable, automatable abuse. There is no KEV listing and no public exploit identified. The main tension is that a high CVSS (7.5) and unauthenticated network reachability could overstate urgency: this is a resource-exhaustion DoS with no confidentiality or integrity impact, so it warrants routine patching rather than crisis response, especially for internet-exposed instances. Note SSVC 'partial' technical impact aligns with a degradation/DoS outcome, not full compromise.

An attacker who can reach the Mattermost server over the network (no authentication required, low complexity) sends one or more crafted HTTP requests with oversized bodies to a plugin endpoint. The server reads and buffers the unbounded payload, consuming excessive memory and CPU, and repeated or large requests degrade or crash the service, denying access to legitimate users. No public exploit is currently identified, but the low attack complexity means a simple script could reproduce it.