Skip to content
Fencer Intel
high 8.7

CVE-2026-6346 json

Sensitive credentials exposed in plaintext in Mattermost support packets

published 5mo ago modified 28d ago also GHSA-9p64-jpc7-m2rp , GO-2026-5293 , EUVD-2026-30754

cvss
8.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access to a support packet to obtain sensitive credentials in plaintext via downloading a support packet from the System Console.. Mattermost Advisory ID: MMSA-2026-00607

Patch / fix

  • go github.com/mattermost/mattermost/server/v8 8.0.0-20260326202606-fac92f4a71f3, 10.11.14, 11.4.4, 11.5.2
  • go github.com/mattermost/mattermost-server 5.3.2-0.20260326202606-fac92f4a71f3, 10.11.14+incompatible, 11.4.4+incompatible, 11.5.2+incompatible
  • Mattermost Mattermost 10.11.14, 11.4.4, 11.5.2, 11.6.0
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

Is CVE-2026-6346 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
5mo ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
GitHub 3.1 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/mattermost/mattermost/server/v8
>=11.5.0, <11.5.2
>=10.11.0, <10.11.14
>=11.4.0, <11.4.4
<8.0.0-20260326202606-fac92f4a71f3
11.5.2
10.11.14
11.4.4
8.0.0-20260326202606-fac92f4a71f3
go github.com/mattermost/mattermost-server
<5.3.2-0.20260326202606-fac92f4a71f3
>=10.11.0+incompatible, <10.11.14+incompatible
>=11.4.0+incompatible, <11.4.4+incompatible
>=11.5.0+incompatible, <11.5.2+incompatible
5.3.2-0.20260326202606-fac92f4a71f3
10.11.14+incompatible
11.4.4+incompatible
11.5.2+incompatible
go github.com/mattermost/mattermost-server/v5
all versions
 no fix listed
go github.com/mattermost/mattermost-server/v6
all versions
 no fix listed

Affected products

  • Mattermost Mattermost

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.