CVEvulnerability

CVE-2026-9699

6.8 MEDIUM Published 2026-06-26 Modified 2026-06-26 Official page ↗
Status
Awaiting Analysis
Published
2026-06-26
Last modified
2026-06-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-532

Description

Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with access to server logs or support packets to obtain a valid or partially reconstructable OpenAI API key via inspection of mattermost.log entries generated during authentication failures. Mattermost Advisory ID: MMSA-2026-00609

Related

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References