CVE-2026-19541 Mattermost CVE debrief

Who should care

Defenders managing Mattermost deployments with outgoing OAuth connections should assess exposure and verify the security of their configurations. This includes reviewing the CVE record, Mattermost advisory, and other relevant sources to understand the vulnerability and its potential impact. Additionally, defenders should prioritize verifying and securing OAuth connections, especially in Mattermost deployments with outgoing OAuth connections.

Why it matters

CVE-2026-19541 is a medium-severity vulnerability in Mattermost that allows authenticated users to obtain client secrets. Defenders managing Mattermost deployments with outgoing OAuth connections should assess exposure and verify the security of their configurations.

• Authenticated users with permission to manage outgoing OAuth connections can obtain client secrets
• Weakness in OAuth connection validation allows potential unauthorized access to sensitive information

Technical summary

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 have a weakness in OAuth connection validation, allowing authenticated users with permission to manage outgoing OAuth connections to obtain client secrets by pointing the token URL at an attacker-controlled endpoint and triggering validation. The vulnerability is caused by the failure to require re-entry of the stored client secret when validating an outgoing OAuth connection. This allows potential unauthorized access to sensitive information.

Defensive priority

Defenders should prioritize verifying and securing OAuth connections, especially in Mattermost deployments with outgoing OAuth connections.

Recommended defensive actions

• Verify and secure OAuth connections in Mattermost deployments
• Restrict access to manage outgoing OAuth connections
• Monitor for suspicious activity related to OAuth connections
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and Mattermost advisory provide details on the vulnerability. However, the scope of affected versions and potential impact require further verification. The Mattermost advisory (MMSA-2026-00761) confirms the vulnerability and provides additional context. Defenders should verify the security of their configurations, especially in Mattermost deployments with outgoing OAuth connections. The CVE Program record (CVE-2026-19541) also provides source-provided CVE metadata. To verify exposure, defenders should review the CVE-6-

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.