What is the CVSS score of CVE-2026-6333?

CVE-2026-6333 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-6333?

Yes, a patch is available for CVE-2026-6333. Update the affected software to the latest version immediately.

Mattermost CVE-2026-6333

Q: Which versions of Mattermost are affected by CVE-2026-6333?

Server-Side Request Forgery in Mattermost 10.11.x through 11.5.1 allows authenticated attackers with slash command access to redirect custom slash command responses to attacker-controlled servers by…. A patch is available.

EUVD-2026-30755 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-18 Mattermost

GHSA-vqp5-2mrp-qqxg

SSRF Mattermost

3.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.5 LOW

AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 09:31 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an attacker-controlled server via a spoofed Host header.. Mattermost Advisory ID: MMSA-2026-00582

AnalysisAI

Server-Side Request Forgery in Mattermost 10.11.x through 11.5.1 allows authenticated attackers with slash command access to redirect custom slash command responses to attacker-controlled servers by manipulating the Host header. The vulnerability requires low-privileged authentication and high attack complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N), resulting in a CVSS score of 3.5. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis. Vendor advisory available at mattermost.com/security-updates provides remediation guidance.

Technical ContextAI

This vulnerability stems from improper Host header validation (CWE-918: Server-Side Request Forgery) in Mattermost's custom slash command response mechanism. Slash commands are webhook-based integrations allowing users to trigger external actions from chat interface. When constructing response URLs for slash command callbacks, Mattermost versions 10.11.x through 10.11.13 and 11.5.x through 11.5.1 fail to properly validate or sanitize the HTTP Host header received from client requests. Attackers can inject a malicious Host header value, causing the server to construct response URLs pointing to attacker-controlled domains. The CPE string cpe:2.3:a:mattermost:mattermost indicates the core Mattermost server application is affected across both the 10.11.x and 11.5.x release branches. The scope change (S:C) in CVSS indicates impact extends beyond the vulnerable component itself, as responses may be redirected outside the intended trust boundary.

RemediationAI

Upgrade to patched Mattermost versions released after 11.5.1 and 10.11.13 per vendor security advisory MMSA-2026-00582 at https://mattermost.com/security-updates. Exact fixed version numbers not provided in available data - consult vendor advisory for current patch releases in the 10.11.x and 11.5.x branches. If immediate patching is infeasible, implement compensating controls: configure reverse proxy or WAF to enforce strict Host header allowlisting matching only legitimate Mattermost server hostnames (trade-off: may break legitimate multi-domain deployments without careful configuration); disable custom slash commands entirely if business processes permit (trade-off: eliminates webhook-based automation workflows); implement network egress filtering to block slash command response callbacks to external IP ranges (trade-off: breaks legitimate external integrations, requires ongoing allowlist maintenance). Monitor logs for anomalous Host header values in slash command requests as detection measure.