Executive brief
Mattermost, a popular collaboration and messaging platform, is vulnerable to a flaw in how it handles automated message notifications (webhooks). An authenticated user can send a specially crafted message that causes the Mattermost server to crash, leading to a total service outage for all users. This disruption can halt business communications and incident response activities until the server is manually restarted.
Technical details
A denial of service vulnerability exists in Mattermost Server due to improper validation of webhook attachment payloads. The application fails to filter 'nil' (null) elements from outgoing webhook attachment arrays before processing them. An authenticated attacker can exploit this by providing a crafted webhook callback response containing a null attachment entry, which triggers a nil pointer dereference or similar unhandled exception, resulting in immediate termination of the server process. The vulnerability is tracked as MMSA-2026-00641 and has been patched in versions 11.6.1, 11.5.4, 11.4.5, and 10.11.15.
Affected products
- Mattermost Mattermost Server 11.6.0, 11.5.0 - 11.5.3, 11.4.0 - 11.4.4, 10.11.0 - 10.11.14
Timeline
- 2026-05-25: disclosed: NVD publication date
- 2026-05-26: advisory: GitHub Advisory published
- 2026-06-30: patched: Advisory updated with patch details