EUVD-2026-39778
GHSA-gr4w-63r3-8h38
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
PR:H because log and support-packet access requires System Admin role; S:C and C:H because the leaked credential grants access to an external OpenAI account; I:N and A:N because Mattermost itself suffers no write or availability impact.
Primary rating from Vendor (mattermost).
CVSS VectorVendor: mattermost
Lifecycle Timeline
1DescriptionCVE.org
Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with access to server logs or support packets to obtain a valid or partially reconstructable OpenAI API key via inspection of mattermost.log entries generated during authentication failures. Mattermost Advisory ID: MMSA-2026-00609
AnalysisAI
Credential exposure in Mattermost Plugins (all branches ≤11.6, fixed in 10.18.11, 11.3.6, and 11.6.5.0) leaks valid or partially reconstructable OpenAI API keys into mattermost.log when the OpenAI API returns authentication failure responses. Any user with privileged read access to server logs or downloadable support packets can recover the key and authenticate to the victim organization's OpenAI account. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS Scope:Changed rating reflects that successful exploitation grants unauthorized access to an external, out-of-scope resource - the OpenAI account - with full confidentiality impact.
Technical ContextAI
The vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File), a well-understood class of credential-leakage defect. Mattermost Plugins bridge the Mattermost team-messaging platform with the OpenAI API, passing authentication credentials as part of API request headers. When OpenAI returns an error response - for example due to an invalid, expired, or rate-limited key - the plugin forwards the raw error body to the Mattermost structured logger without redacting credential material. Because OpenAI error payloads may echo back key fragments or include the submitted Authorization header in diagnostic fields, these values are written verbatim to mattermost.log. The Scope:Changed (S:C) metric in the CVSS vector is appropriate: the confidentiality impact falls outside the Mattermost authorization boundary on an external third-party service. CPE data was not explicitly supplied, but the affected scope is Mattermost's plugin ecosystem across the 10.x, 11.3.x, and 11.6.x release trains.
RemediationAI
The primary remediation is to upgrade to a fixed release of Mattermost Plugins: version 10.18.11 on the 10.x branch, 11.3.6 on the 11.3.x branch, or 11.6.5.0 on the 11.6.x branch, as documented at https://mattermost.com/security-updates. After upgrading, administrators should immediately rotate the OpenAI API key configured in the plugin, since any key logged prior to patching must be considered compromised - key rotation carries no service disruption beyond a brief plugin reconfiguration window. As a compensating control where immediate upgrade is not possible, restrict read access to mattermost.log and the support packet download feature to only the minimum set of trusted administrators; this does not prevent the key from being written to logs but reduces the exposure window. Additionally, configure OpenAI API key scoping to the minimum required permissions and enable usage alerts on the OpenAI account to detect unauthorized consumption. No adverse side effects from the patch itself have been identified in the advisory.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today