Mattermost 11.5.1 Sensitive Config Leak via Support Pack Generation
CVE-2026-6346 Published on May 18, 2026

Sensitive credentials exposed in plaintext in Mattermost support packets
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access to a support packet to obtain sensitive credentials in plaintext via downloading a support packet from the System Console.. Mattermost Advisory ID: MMSA-2026-00607

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-6346 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

What is an Information Disclosure Vulnerability?

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVE-2026-6346 has been classified to as an Information Disclosure vulnerability or weakness.


Products Associated with CVE-2026-6346

Want to know whenever a new CVE is published for MatterMost? stack.watch will email you.

MatterMost
 

Affected Versions

Mattermost: