# CVE-2026-19600: Mattermost authentication token leak in server logs

Source: https://junglewise.ai/threats/cve-2026-19600-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-19600 · Severity: medium · CVSS 4.5 · Published 2026-10-16

Mattermost is a team communication and collaboration platform. Affected versions fail to remove authentication tokens from debug logs, allowing anyone with access to server log files to steal valid session or OAuth tokens and impersonate users. An attacker with log access could gain unauthorized access to accounts and data.

Technologies: [Mattermost Server](https://junglewise.ai/threats/technologies/server-public). Vendors: [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-19600 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19600 being exploited in the wild.

**How severe is CVE-2026-19600?** Medium severity, with a CVSS score of 4.5, published 16 October 2026.

**Which products and versions are affected?** Mattermost Server 11.7.x <= 11.7.10, 11.8.x <= 11.8.5, 11.9.x <= 11.9.1, 11.10.x <= 11.10.1.

**Is there a fix for CVE-2026-19600?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19600 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2026-19600?** Check whether you run Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Mattermost fails to sanitize authentication tokens before writing them to debug-level server logs, creating an information disclosure vulnerability. An attacker with access to server log files can extract valid session tokens or OAuth access tokens and use them to impersonate authenticated users. This affects versions 11.7.x through 11.10.x as specified.

## Affected products

- Mattermost Mattermost Server 11.7.x <= 11.7.10, 11.8.x <= 11.8.5, 11.9.x <= 11.9.1, 11.10.x <= 11.10.1

## Timeline

- 2026-10-16: disclosed

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost CSRF via Agents plugin mention reminder validation](https://junglewise.ai/threats/cve-2026-93851-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10)
- [Mattermost denial of service via PDF text extraction memory exhaustion](https://junglewise.ai/threats/cve-2026-93850-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)
- [Mattermost denial of service in WebSocket msgpack decoder](https://junglewise.ai/threats/cve-2026-93849-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)
- [Mattermost information disclosure in post deletion events](https://junglewise.ai/threats/cve-2026-19621-mattermost-versions-11-10-x-11-10-0-11-7-x-11-7-9-11-9-x-11-9-1)
- [Mattermost authentication bypass in OAuth account takeover](https://junglewise.ai/threats/cve-2026-19076-mattermost-versions-11-10-x-11-10-0-11-7-x-11-7-9-11-9-x-11-9-1)