What is the CVSS score of CVE-2026-6346?

CVE-2026-6346 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by CVE-2026-6346?

Mattermost versions through 11.5.1 leak sensitive credentials including database passwords and API keys in plaintext within support packets accessible from the System Console, creating immediate risk…. A patch is available.

How to fix or mitigate CVE-2026-6346?

Within 24 hours: Restrict System Console access to only essential administrators and disable support packet download functionality if available via administrative controls. Within 7 days: Audit all downloaded support packets for credential exposure and rotate all passwords, API keys, and secrets referenced in Mattermost configuration (database credentials, LDAP/SAML bindings, webhook tokens, OAuth secrets). Within 30 days: Upgrade to Mattermost 11.6.0 or later when available, or implement version-specific patches if released for 10.11.x and 11.4.x branches; verify credential sanitization in support packets post-upgrade.

Mattermost CVE-2026-6346

EUVD-2026-30754 HIGH

Information Exposure (CWE-200)

2026-05-18 Mattermost

GHSA-9p64-jpc7-m2rp

Mattermost Information Disclosure

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 09:30 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access to a support packet to obtain sensitive credentials in plaintext via downloading a support packet from the System Console.. Mattermost Advisory ID: MMSA-2026-00607

AnalysisAI

Mattermost versions up to 11.5.1 expose sensitive credentials in plaintext within support packets due to insufficient sanitization of configuration fields. System administrators or anyone with access to support packets can obtain database passwords, API keys, and other sensitive credentials by downloading support packets from the System Console. The vulnerability affects multiple version branches (10.11.x, 11.4.x, 11.5.x) and poses significant risk for credential theft and lateral movement.

Technical ContextAI

Mattermost is an open-source team collaboration platform that includes a support packet generation feature for troubleshooting. The vulnerability stems from CWE-200 (Information Exposure), where the application fails to sanitize sensitive configuration fields before including them in support packets. These packets are intended to help with debugging and support but inadvertently contain plaintext credentials from the system configuration, including database connection strings, SMTP passwords, and integration API keys.

RemediationAI

Upgrade to patched versions of Mattermost beyond 11.5.1 for the 11.5.x branch, beyond 10.11.13 for the 10.11.x branch, or beyond 11.4.3 for the 11.4.x branch. The exact patched version numbers are not specified in the available data but would be found in the vendor advisory at https://mattermost.com/security-updates. As an immediate workaround, restrict access to the System Console and support packet generation feature to only essential administrators, implement audit logging for support packet downloads, and ensure any generated support packets are transmitted and stored securely. Consider rotating all credentials that may have been exposed in previously generated support packets.