Executive brief
Mattermost, a collaboration platform for secure communication, contains a vulnerability in how it handles AI bot messages. An attacker can use specially crafted text to trick a user's computer into sending information to an external server controlled by the attacker. This could lead to the unauthorized disclosure of sensitive internal data when a victim views a message generated by an AI tool.
Technical details
A protection mechanism failure (CWE-693) exists in Mattermost's handling of AI bot tool result posts. The application fails to enforce markdown image rendering restrictions on content generated by AI tools. An authenticated attacker can exploit this by injecting markdown image syntax into tool result content. When a victim's client renders this content, it may automatically request the image from an attacker-controlled URL, potentially appending sensitive data to the request and resulting in data exfiltration. The vulnerability is fixed in versions 10.11.19, 11.5.7, and 11.6.4.
Affected products
- Mattermost Mattermost Server 10.11.0 - 10.11.18, 11.5.0 - 11.5.6, 11.6.0 - 11.6.3
Timeline
- 2026-06-26: disclosed
- 2026-06-26: advisory