CVE-2026-4339
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server
Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the Mattermost Agents plugin MCP server which allows an attacker with access to the MCP server in stdio mode to perform server-side request forgery (SSRF) and exfiltrate data from internal network services via supplying internal URLs as file attachments in post creation requests.. Mattermost Advisory ID: MMSA-2026-00635
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Mattermost
- Vendor
- Mattermost
- Product
- Mattermost
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 10.11.0 | affected | semver | Unavailable | 10.11.18 | None listed |
| 11.6.0 | affected | semver | Unavailable | 11.6.3 | None listed |
| 11.5.0 | affected | semver | Unavailable | 11.5.6 | None listed |
| 11.7.0 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 10.11.19 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 11.6.4 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 11.5.7 | unaffected | Unavailable | Unavailable | Unavailable | None listed |