EUVD-2026-30754
GHSA-9p64-jpc7-m2rp
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
1DescriptionNVD
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access to a support packet to obtain sensitive credentials in plaintext via downloading a support packet from the System Console.. Mattermost Advisory ID: MMSA-2026-00607
AnalysisAI
Mattermost versions up to 11.5.1 expose sensitive credentials in plaintext within support packets due to insufficient sanitization of configuration fields. System administrators or anyone with access to support packets can obtain database passwords, API keys, and other sensitive credentials by downloading support packets from the System Console. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Restrict System Console access to only essential administrators and disable support packet download functionality if available via administrative controls. Within 7 days: Audit all downloaded support packets for credential exposure and rotate all passwords, API keys, and secrets referenced in Mattermost configuration (database credentials, LDAP/SAML bindings, webhook tokens, OAuth secrets). …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today