Executive brief
Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint in github.com/mattermost/mattermost-plugin-msteams
Affected products
- Go github.com/mattermost/mattermost-plugin-msteams
Junglewise Threat Intelligence
CVE-2026-21388: GO-2026-5734 - Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint in github.com/mattermost/mattermost-plugin
CVE-2026-21388 · Severity: low · CVSS 3.1 · Published 2026-06-25
Technologies: github.com/mattermost/mattermost-plugin-msteams (Go). Vendors: Go.
Related threats
- GO-2026-5153 - Mattermost MS Teams plugin doesn't limit the request body size on the /changes webhook endpoint in github.com/mattermost/mattermost-plugin-m
- GO-2026-4784 - Mattermost Microsoft Teams Plugin fails to properly mask sensitive configuration values in github.com/mattermost/mattermost-plugin-msteams
- GO-2025-3618 - Mattermost vulnerable to Observable Timing Discrepancy in github.com/mattermost/mattermost-plugin-msteams