CVE-2026-96259 in Mattermost
Summary
by MITRE • 09/23/2026
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the configured OAuth token and userinfo endpoints.. Mattermost Advisory ID: MMSA-2026-00776
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Mattermost versions 11.9.x through 11.9.1, 11.8.x through 11.8.5, 11.7.x through 11.7.10, and 11.10.x through 11.10.1 represents a critical failure in input validation and access control mechanisms within the OAuth integration workflow. Specifically, the application fails to enforce an internal-connection filter when processing requests directed at OAuth endpoints. This architectural oversight allows authenticated System Administrators to manipulate the server into initiating outbound HTTP connections to arbitrary destinations, including private or internal network addresses that are typically inaccessible from external networks due to firewall rules and network segmentation policies. The core technical flaw lies in the absence of strict URL validation during the construction of requests sent by the Mattermost backend on behalf of the administrator user context when interacting with OAuth providers for token exchange or userinfo retrieval operations.
From a technical perspective, this vulnerability exploits the principle that administrative functions often operate with elevated privileges and broader network permissions than standard user actions. By leveraging the configured OAuth token and userinfo endpoints, an attacker who has obtained System Administrator credentials can craft malicious requests that direct the Mattermost server to act as a proxy or client for internal services. The server issues these requests using its own network identity and potentially valid authentication tokens associated with the integration configuration. Consequently, any response returned by the targeted internal service is relayed back through the OAuth endpoint mechanism to the administrator's session. This effectively bypasses standard network perimeter defenses because the traffic originates from a trusted internal host rather than an external source, rendering traditional ingress filtering ineffective against this specific attack vector.
The operational impact of this vulnerability extends beyond simple data exfiltration and encompasses significant risks related to server-side request forgery and lateral movement within the enterprise environment. An attacker can utilize this capability to probe internal services that are not exposed to the public internet, such as database management interfaces, administrative consoles for other applications, or IoT devices connected to the local network. By reading the responses from these endpoints, the attacker may extract sensitive configuration data, session cookies, API keys, or even exploit secondary vulnerabilities in those internal services using information gathered from their HTTP headers and response bodies. This transforms a single compromised administrator account into a powerful pivot point for deeper infiltration of the organization's infrastructure, potentially leading to full system compromise if critical internal assets are targeted.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-918 Server-Side Request Forgery and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving T1563 Remote Service Session Hijacking if session tokens are stolen from internal services, or more broadly T1078 Valid Accounts when leveraging compromised admin credentials for unauthorized access. The lack of egress filtering controls specific to administrative functions also reflects weaknesses in CWE-922 Insecure Storage of Credentials if the OAuth secrets were improperly managed alongside this logic flaw.
To mitigate this risk, organizations running affected versions must immediately upgrade Mattermost to a patched release where the internal-connection filter is correctly applied to all outbound requests initiated by OAuth endpoints. Until an upgrade can be performed, network-level mitigations should be implemented at the firewall or proxy layer to restrict egress traffic from the Mattermost server IP address to only known and necessary external domains. Additionally, implementing strict output encoding and URL validation on any custom integrations that interact with these endpoints is advisable. Security teams should also audit access logs for unusual outbound connection patterns originating from the application server and enforce multi-factor authentication for all administrative accounts to reduce the likelihood of credential compromise leading to exploitation of this flaw.