EUVD-2026-39778
GHSA-gr4w-63r3-8h38
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
PR:H because log and support-packet access requires System Admin role; S:C and C:H because the leaked credential grants access to an external OpenAI account; I:N and A:N because Mattermost itself suffers no write or availability impact.
Primary rating from Vendor (mattermost).
CVSS VectorVendor: mattermost
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with access to server logs or support packets to obtain a valid or partially reconstructable OpenAI API key via inspection of mattermost.log entries generated during authentication failures. Mattermost Advisory ID: MMSA-2026-00609
AnalysisAI
Credential exposure in Mattermost Plugins (all branches ≤11.6, fixed in 10.18.11, 11.3.6, and 11.6.5.0) leaks valid or partially reconstructable OpenAI API keys into mattermost.log when the OpenAI API returns authentication failure responses. Any user with privileged read access to server logs or downloadable support packets can recover the key and authenticate to the victim organization's OpenAI account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the attacker must hold high-privileged access to Mattermost - specifically the ability to read mattermost.log directly on the server or to download a support packet via the System Console (a Mattermost System Admin role); and (2) at least one OpenAI API authentication failure event must have been generated and logged while a vulnerable plugin version was active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 6.8 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N correctly captures the core dynamic: exploitation is trivially simple once an attacker has high-privileged log access, but that privilege requirement (PR:H) is itself a meaningful barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious Mattermost system administrator - or an attacker who has compromised an admin account - downloads a support packet from the Mattermost System Console after a period during which the OpenAI plugin experienced API authentication failures (for example, after an accidental key misconfiguration). Reviewing mattermost.log within the support bundle, the attacker locates log entries containing the unsanitized OpenAI error payload and extracts the API key or a reconstructable fragment. … |
| Remediation | The primary remediation is to upgrade to a fixed release of Mattermost Plugins: version 10.18.11 on the 10.x branch, 11.3.6 on the 11.3.x branch, or 11.6.5.0 on the 11.6.x branch, as documented at https://mattermost.com/security-updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mattermost
View allDenial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invit
Dex is a federated OpenID Connect provider written in Go. Rated critical severity (CVSS 9.6), this vulnerability is remo
Improper output escaping in NousResearch Hermes Agent versions up to 2026.4.16 allows remote unauthenticated attackers t
Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, wh
Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker posse
Privilege escalation in Mattermost server (11.6.x, 11.5.x, and 10.11.x branches) allows a low-privileged user holding gr
Authorization bypass in Mattermost Plugin Legal Hold versions <=1.1.4 allows authenticated attackers to manipulate legal
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today