CVEvulnerability

CVE-2026-4339

6.5 MEDIUM Published 2026-06-26 Modified 2026-06-29 Official page ↗
Status
Analyzed
Published
2026-06-26
Last modified
2026-06-29
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-918

Description

Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the Mattermost Agents plugin MCP server which allows an attacker with access to the MCP server in stdio mode to perform server-side request forgery (SSRF) and exfiltrate data from internal network services via supplying internal URLs as file attachments in post creation requests.. Mattermost Advisory ID: MMSA-2026-00635

Affected configurations

• mattermost mattermost server (>= 10.11.0 < 10.11.19) • mattermost mattermost server (>= 11.5.0 < 11.5.7) • mattermost mattermost server (>= 11.6.0 < 11.6.4)

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References