# CVE-2026-4915: Mattermost Server denial of service via null webhook attachment Source: https://junglewise.ai/threats/cve-2026-4915-mattermost-server-denial-of-service-via-null-webhook-attachment Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-05-25. Updated: 2026-06-30 License: CC BY 4.0 with a link back CVE-2026-4915 · Severity: medium · CVSS 6.5 · Published 2026-05-25 Mattermost, a popular collaboration and messaging platform, is vulnerable to a flaw in how it handles automated message notifications (webhooks). An authenticated user can send a specially crafted message that causes the Mattermost server to crash, leading to a total service outage for all users. This disruption can halt business communications and incident response activities until the server is manually restarted. Technologies: [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server), [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5), [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6), [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8), [Mattermost Server](https://junglewise.ai/threats/technologies/server-public). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Mattermost](https://junglewise.ai/threats/vendors/mattermost). ## Quick answers **Is CVE-2026-4915 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4915 being exploited in the wild. **How severe is CVE-2026-4915?** Medium severity, with a CVSS score of 6.5, published 25 May 2026. **Which products and versions are affected?** github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.15+incompatible,introduced=11.4.0+incompatible,fixed=11.4.5+incompatible,introduced=11.5.0+incompatible,fixed=11.5.4+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=0,fixed=8.0.0-20260407102538-faa7d75b4ea0; and 1 more. **Is there a fix for CVE-2026-4915?** Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260407102538-faa7d75b4ea0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-4915 attacked?** It is attacked over the network, in a hosted service. **Am I affected by CVE-2026-4915?** Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later ```sh go get github.com/mattermost/mattermost-server@v11.6.1+incompatible ``` - github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260407102538-faa7d75b4ea0 or later ```sh go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260407102538-faa7d75b4ea0 ``` ## Technical details A denial of service vulnerability exists in Mattermost Server due to improper validation of webhook attachment payloads. The application fails to filter 'nil' (null) elements from outgoing webhook attachment arrays before processing them. An authenticated attacker can exploit this by providing a crafted webhook callback response containing a null attachment entry, which triggers a nil pointer dereference or similar unhandled exception, resulting in immediate termination of the server process. The vulnerability is tracked as MMSA-2026-00641 and has been patched in versions 11.6.1, 11.5.4, 11.4.5, and 10.11.15. ## Affected products - Mattermost Mattermost Server 11.6.0, 11.5.0 - 11.5.3, 11.4.0 - 11.4.4, 10.11.0 - 10.11.14 ## Identifiers - CVE-2026-4915 - GHSA-5gmf-x7hg-97wf - GO-2026-5845 ## Timeline - 2026-05-25: disclosed: NVD publication date - 2026-05-26: advisory: GitHub Advisory published - 2026-06-30: patched: Advisory updated with patch details ## References - [https://mattermost.com/security-updates](https://mattermost.com/security-updates) - [https://github.com/mattermost/mattermost/commit/faa7d75b4ea041701e97948f8aa1332e3626a39a](https://github.com/mattermost/mattermost/commit/faa7d75b4ea041701e97948f8aa1332e3626a39a) ## Related threats - [Mattermost CSRF via Agents plugin mention reminder validation](https://junglewise.ai/threats/cve-2026-93851-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10) - [Mattermost denial of service via PDF text extraction memory exhaustion](https://junglewise.ai/threats/cve-2026-93850-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11) - [Mattermost denial of service in WebSocket msgpack decoder](https://junglewise.ai/threats/cve-2026-93849-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11) - [Mattermost information disclosure in post deletion events](https://junglewise.ai/threats/cve-2026-19621-mattermost-versions-11-10-x-11-10-0-11-7-x-11-7-9-11-9-x-11-9-1) - [Mattermost authentication token leak in server logs](https://junglewise.ai/threats/cve-2026-19600-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)