PatchSiren cyber security CVE debrief

CVE-2026-10600 Mattermost CVE debrief

CVE-2026-10600 is a medium-severity vulnerability in Mattermost that allows an authenticated user with file-upload permission to degrade file uploads for all users on the server. The vulnerability is caused by a failure to bound the time and resource consumption of server-side document content extraction. This can lead to a denial-of-service (DoS) condition, where an attacker can repeatedly upload small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool. As a result, file uploads may become slow or unresponsive for all users on the server.

Vendor: Mattermost
Product: Unknown
CVSS: MEDIUM 4.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-27
Original CVE updated: 2026-07-27
Advisory published: 2026-07-27
Advisory updated: 2026-07-27

Who should care

Users of Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 who have file-upload permission should be aware of this vulnerability. These users should review and update Mattermost to a version that is not vulnerable, limit file-upload permission to only those who need it, and monitor server resource usage for signs of exploitation.

Technical summary

The vulnerability allows an authenticated user with file-upload permission to repeatedly upload small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool and degrading file uploads for all users on the server. This is caused by a failure to bound the time and resource consumption of server-side document content extraction. The vulnerability has a CVSS score of 4.3 and a severity of MEDIUM. The affected products are Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20.

Defensive priority

Medium

Recommended defensive actions

Review and update Mattermost to a version that is not vulnerable
Limit file-upload permission to only those who need it
Monitor server resource usage for signs of exploitation
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-27T15:16:46.623Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. There is limited information available about this vulnerability, and defenders should verify the affected scope and severity with the vendor. The vulnerability allows an authenticated user with file-upload permission to repeatedly upload small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool and degrading file uploads for all users on the server.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-27T15:16:46.623Z and has not been modified since then.