Mattermost up to 11.6.x Remote Cluster API insertion of sensitive information into sent data

Summaryinfo

A vulnerability classified as problematic has been found in Mattermost up to 10.11.15/10.11.16/11.5.4/11.6.1/11.6.x. This issue affects some unknown processing of the component Remote Cluster API. The manipulation leads to insertion of sensitive information into sent data. This vulnerability is traded as CVE-2026-7184. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Mattermost up to 10.11.15/10.11.16/11.5.4/11.6.1/11.6.x. This issue affects some unknown processing of the component Remote Cluster API. The manipulation with an unknown input leads to a insertion of sensitive information into sent data vulnerability. Using CWE to declare the problem leads to CWE-201. The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. Impacted is confidentiality. The summary by CVE is:

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the {{manage_secure_connections}} permission to obtain remote cluster authentication tokens via a PATCH request to the remote cluster endpoint.. Mattermost Advisory ID: MMSA-2026-00662

The weakness was shared by winfunc. The advisory is shared at mattermost.com. The identification of this vulnerability is CVE-2026-7184 since 04/27/2026. The exploitation is known to be easy. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 10.11.17, 11.5.5, 11.6.2 or 11.7.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-36500). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Groupware Software

Name

• Mattermost

Version

• 10.11.0
• 10.11.1
• 10.11.2
• 10.11.3
• 10.11.4
• 10.11.5
• 10.11.6
• 10.11.7
• 10.11.8
• 10.11.9
• 10.11.10
• 10.11.11
• 10.11.12
• 10.11.13
• 10.11.14
• 10.11.15
• 10.11.16
• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.5.0
• 11.5.1
• 11.5.2
• 11.5.3
• 11.5.4
• 11.6
• 11.6.0
• 11.6.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion