Mattermost Calls CVE-2026-6347

Exploitation requires authenticated administrator access to generate or access Mattermost support packets containing the Calls plugin configuration. The vulnerability only manifests when the Mattermost Calls plugin is installed and configured with TURN servers. Organizations that never generate support packets or tightly control access to them face minimal risk. The attack cannot be performed by regular users or through the standard Mattermost interface.

CVSS 7.6 indicates high severity with network vector and high privileges required, but the real-world risk depends heavily on support packet handling practices. The attack requires authenticated admin access (PR:H) and is not complex (AC:L), but exploitation is limited to scenarios where support packets are generated and accessed. No EPSS data or KEV listing suggests this is not being actively exploited. The Changed scope (S:C) indicates credential theft could impact systems beyond Mattermost itself, as TURN credentials might be reused. The primary risk is to organizations that frequently generate support packets or have loose controls over who accesses them.

A malicious insider or compromised admin account generates a Mattermost support packet for seemingly legitimate troubleshooting purposes. They extract the plaintext TURN server credentials from the Calls plugin configuration within the packet, then use these credentials to potentially eavesdrop on or disrupt WebRTC calls by accessing the TURN infrastructure directly.