PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-4339 Mattermost CVE debrief

CVE-2026-4339 is a medium-severity vulnerability affecting Mattermost Server versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, and 11.5.x <= 11.5.6. The vulnerability is caused by a failure to validate attachment URLs against internal or private IP ranges in the Mattermost Agents plugin MCP server. This allows an attacker with access to the MCP server in stdio mode to perform server-side request forgery (SSRF) attacks and exfiltrate data from internal network services by supplying internal URLs as file attachments in post creation requests. The vulnerability has a CVSS score of 6.5 and is classified as CWE-918. Mattermost has released an advisory (MMSA-2026-00635) addressing this issue.

Vendor
Mattermost
Product
Mattermost Server
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-26
Original CVE updated
2026-06-29
Advisory published
2026-06-26
Advisory updated
2026-06-29

Who should care

Organizations using Mattermost Server versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, and 11.5.x <= 11.5.6 should prioritize patching this vulnerability to prevent potential SSRF attacks. Security teams and administrators responsible for maintaining Mattermost installations should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The vulnerability exists in the Mattermost Agents plugin MCP server, which fails to validate attachment URLs against internal or private IP ranges. This allows an attacker to perform SSRF attacks by supplying internal URLs as file attachments in post creation requests. The vulnerability has a CVSS score of 6.5 and is classified as CWE-918. Affected versions include Mattermost Server 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, and 11.5.x <= 11.5.6.

Defensive priority

Patching this vulnerability is of medium priority due to its CVSS score of 6.5. Organizations should apply the patches as soon as possible to prevent potential SSRF attacks.

Recommended defensive actions

  • Apply patches for Mattermost Server versions 10.11.x, 11.6.x, and 11.5.x to address the vulnerability.
  • Restrict access to the MCP server in stdio mode to prevent unauthorized access.
  • Monitor Mattermost Server logs for suspicious activity related to SSRF attacks.
  • Implement additional security measures, such as IP range validation, to prevent SSRF attacks.
  • Review and update incident response plans to address potential SSRF attacks.

Evidence notes

The vulnerability is documented in the CVE-2026-4339 record and the Mattermost Advisory ID: MMSA-2026-00635. The NVD provides detailed information about the vulnerability, including its CVSS score and affected versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-4339 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-4339

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-4339 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-4339

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.