What is the CVSS score of EUVD-2026-12441?

EUVD-2026-12441 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by EUVD-2026-12441?

CVE-2026-2455 presents moderate security risk, a server-side request forgery vulnerability rated CVSS 4.3. Users could be tricked into performing unintended actions.. A patch is available.

How to fix or mitigate EUVD-2026-12441?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Mattermost EUVD-2026-12441

| CVE-2026-2455 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-16 responsibledisclosure@mattermost.com

GHSA-gqv7-j2j8-qmwq

SSRF Mattermost Mattermost Server Suse

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 15:30 euvd

EUVD-2026-12441

Analysis Generated

Mar 16, 2026 - 15:30 vuln.today

CVE Published

Mar 16, 2026 - 15:16 nvd

MEDIUM 4.3

DescriptionCVE.org

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation which allows an attacker to perform SSRF attacks against internal services via IPv4-mapped IPv6 literals (e.g., [::ffff:127.0.0.1]).. Mattermost Advisory ID: MMSA-2026-00585

AnalysisAI

Mattermost Server versions 11.3.0, 11.2.x through 11.2.2, and 10.11.x through 10.11.10 contain a server-side request forgery (SSRF) vulnerability due to improper validation of IPv4-mapped IPv6 addresses, allowing authenticated attackers to bypass reserved IP restrictions and access internal services. An attacker with login credentials can craft requests using IPv6 notation (such as [::ffff:127.0.0.1]) to reach localhost or other restricted internal endpoints that would normally be blocked. No patch is currently available for this vulnerability.

Technical ContextAI

Server-Side Request Forgery allows an attacker to induce the server to make HTTP requests to arbitrary destinations, including internal services. This vulnerability is classified as Server-Side Request Forgery (SSRF) (CWE-918).

RemediationAI

Validate and whitelist allowed URLs and IP ranges. Block requests to internal/private IP ranges. Use network segmentation to limit server-side request scope.

More in Mattermost

View all

CVE-2025-25279 CRITICAL Act Now

9.9 Feb 24

Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa

CVE-2026-48801 HIGH This Week POC

8.7 Jun 26

Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s

CVE-2022-4044 MEDIUM This Month POC

6.5 Nov 23

A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto

CVE-2022-3257 MEDIUM This Month POC

6.5 Sep 23

Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w

CVE-2025-4981 CRITICAL Act Now

9.9 Jun 20

A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s

CVE-2025-20051 CRITICAL Act Now

9.9 Feb 24

Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp

CVE-2026-4858 CRITICAL Act Now

9.9 May 21

Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the

CVE-2025-12421 CRITICAL Act Now

9.9 Nov 27

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t

CVE-2025-12419 CRITICAL Act Now

9.9 Nov 27

Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat

CVE-2023-6458 CRITICAL Act Now

9.8 Dec 06

Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf

CVE-2020-26276 CRITICAL Act Now

9.8 Dec 17

Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,

CVE-2025-24490 CRITICAL Act Now

9.6 Feb 24

Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all

CVE-2021-34473 CRITICAL POC

9.1

CVE-2021-26855 CRITICAL POC

9.1

CVE-2021-21985 CRITICAL POC

9.8

CVE-2022-41040 HIGH POC

8.8

CVE-2024-21893 HIGH POC

8.2

CVE-2021-40438 CRITICAL POC

9.0

CVE-2021-21975 HIGH POC

7.5

CVE-2023-48022 CRITICAL POC

9.8

Same technique SSRF

View all

CVE-2021-34473 CRITICAL POC

9.1

CVE-2021-26855 CRITICAL POC

9.1

CVE-2021-21985 CRITICAL POC

9.8

CVE-2024-21893 HIGH POC

8.2

CVE-2021-40438 CRITICAL POC

9.0

CVE-2021-21975 HIGH POC

7.5

CVE-2016-3718 MEDIUM POC

5.5

CVE-2026-15409 CRITICAL POC

10.0

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

EUVD-2026-12441 vulnerability details – vuln.today

Back

Mattermost EUVD-2026-12441

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Mattermost

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

Same technique SSRF

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code