What is the CVSS score of CVE-2026-6346?

CVE-2026-6346 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by CVE-2026-6346?

Mattermost versions through 11.5.1 leak sensitive credentials including database passwords and API keys in plaintext within support packets accessible from the System Console, creating immediate risk…. A patch is available.

How to fix or mitigate CVE-2026-6346?

Within 24 hours: Restrict System Console access to only essential administrators and disable support packet download functionality if available via administrative controls. Within 7 days: Audit all downloaded support packets for credential exposure and rotate all passwords, API keys, and secrets referenced in Mattermost configuration (database credentials, LDAP/SAML bindings, webhook tokens, OAuth secrets). Within 30 days: Upgrade to Mattermost 11.6.0 or later when available, or implement version-specific patches if released for 10.11.x and 11.4.x branches; verify credential sanitization in support packets post-upgrade.

Mattermost CVE-2026-6346

EUVD-2026-30754 HIGH

Information Exposure (CWE-200)

2026-05-18 Mattermost

GHSA-9p64-jpc7-m2rp

Information Disclosure Mattermost Suse

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 09:30 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access to a support packet to obtain sensitive credentials in plaintext via downloading a support packet from the System Console.. Mattermost Advisory ID: MMSA-2026-00607

AnalysisAI

Mattermost versions up to 11.5.1 expose sensitive credentials in plaintext within support packets due to insufficient sanitization of configuration fields. System administrators or anyone with access to support packets can obtain database passwords, API keys, and other sensitive credentials by downloading support packets from the System Console. The vulnerability affects multiple version branches (10.11.x, 11.4.x, 11.5.x) and poses significant risk for credential theft and lateral movement.

Technical ContextAI

Mattermost is an open-source team collaboration platform that includes a support packet generation feature for troubleshooting. The vulnerability stems from CWE-200 (Information Exposure), where the application fails to sanitize sensitive configuration fields before including them in support packets. These packets are intended to help with debugging and support but inadvertently contain plaintext credentials from the system configuration, including database connection strings, SMTP passwords, and integration API keys.

RemediationAI

Upgrade to patched versions of Mattermost beyond 11.5.1 for the 11.5.x branch, beyond 10.11.13 for the 10.11.x branch, or beyond 11.4.3 for the 11.4.x branch. The exact patched version numbers are not specified in the available data but would be found in the vendor advisory at https://mattermost.com/security-updates. As an immediate workaround, restrict access to the System Console and support packet generation feature to only essential administrators, implement audit logging for support packet downloads, and ensure any generated support packets are transmitted and stored securely. Consider rotating all credentials that may have been exposed in previously generated support packets.

More in Mattermost

View all

CVE-2025-25279 CRITICAL Act Now

9.9 Feb 24

Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa

CVE-2026-48801 HIGH This Week POC

8.7 Jun 26

Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s

CVE-2022-4044 MEDIUM This Month POC

6.5 Nov 23

A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto

CVE-2022-3257 MEDIUM This Month POC

6.5 Sep 23

Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w

CVE-2025-4981 CRITICAL Act Now

9.9 Jun 20

A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s

CVE-2025-20051 CRITICAL Act Now

9.9 Feb 24

Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp

CVE-2026-4858 CRITICAL Act Now

9.9 May 21

Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the

CVE-2025-12421 CRITICAL Act Now

9.9 Nov 27

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t

CVE-2025-12419 CRITICAL Act Now

9.9 Nov 27

Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat

CVE-2023-6458 CRITICAL Act Now

9.8 Dec 06

Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf

CVE-2020-26276 CRITICAL Act Now

9.8 Dec 17

Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,

CVE-2025-24490 CRITICAL Act Now

9.6 Feb 24

Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen

Same weakness CWE-200 – Information Exposure

View all

CVE-2024-24919 HIGH POC

8.6

CVE-2016-6415 HIGH POC

7.5

CVE-2013-7331 MEDIUM POC

6.5

CVE-2025-31125 MEDIUM POC

5.3

CVE-2025-11749 CRITICAL POC

9.8

CVE-2017-16894 HIGH POC

7.5

CVE-2017-11165 CRITICAL POC

9.8

CVE-2020-3259 HIGH

7.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Server 16.1	Affected
SUSE Linux Enterprise Server for SAP applications 16.1	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP5	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP6	Affected
openSUSE Leap 15.5	Affected

CVE-2026-6346 vulnerability details – vuln.today

Back

Mattermost CVE-2026-6346

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Mattermost

Same weakness CWE-200 – Information Exposure

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code