Is CVE-2026-6673 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6673 being exploited in the wild.

How severe is CVE-2026-6673?

Medium severity, with a CVSS score of 6.4, published 22 June 2026.

Which products and versions are affected?

github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.18+incompatible,introduced=11.5.0+incompatible,fixed=11.5.6+incompatible,introduced=11.6.0+incompatible,fixed=11.6.3+incompatible,introduced=11.7.0+incompatible,fixed=11.7.1+incompatible, SEMVER:introduced=11.7.0,fixed=11.7.1; Mattermost 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17; Mattermost Server 11.7.0, 11.6.0–11.6.2, 11.5.0–11.5.5, 10.11.0–10.11.17.

Is there a fix for CVE-2026-6673?

Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6673 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-6673?

Check whether you run github.com/mattermost/mattermost-server (Go), Mattermost or Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6673: Mattermost authentication bypass in Atlassian Connect callback

Q: Is there a fix for CVE-2026-6673?

Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-6673 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-6673?

Check whether you run github.com/mattermost/mattermost-server (Go), Mattermost or Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6673 · Severity: medium · CVSS 6.4 · Published 2026-06-22

Mattermost is a team communication platform that integrates with Jira through Atlassian Connect. Affected versions fail to authenticate callbacks during Jira integration setup, allowing an unauthenticated attacker to inject a malicious shared secret and disrupt the Jira integration, potentially compromising the integrity of linked issues and workflows.

Technologies: github.com/mattermost/mattermost-server (Go), Mattermost, Mattermost Server. Vendors: Go, Mattermost.

Quick answers

Is CVE-2026-6673 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6673 being exploited in the wild.
How severe is CVE-2026-6673?: Medium severity, with a CVSS score of 6.4, published 22 June 2026.
Which products and versions are affected?: github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.18+incompatible,introduced=11.5.0+incompatible,fixed=11.5.6+incompatible,introduced=11.6.0+incompatible,fixed=11.6.3+incompatible,introduced=11.7.0+incompatible,fixed=11.7.1+incompatible, SEMVER:introduced=11.7.0,fixed=11.7.1; Mattermost 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17; Mattermost Server 11.7.0, 11.6.0–11.6.2, 11.5.0–11.5.5, 10.11.0–10.11.17.
Is there a fix for CVE-2026-6673?: Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6673 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-6673?: Check whether you run github.com/mattermost/mattermost-server (Go), Mattermost or Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later
```
go get github.com/mattermost/mattermost-server@v11.7.1+incompatible
```

Technical details

The vulnerability is a missing authentication issue (CWE-306) in Mattermost's Atlassian Connect integration. The /ac/installed endpoint fails to properly authenticate callbacks from Atlassian Connect during the Jira app installation phase, allowing an unauthenticated attacker with network access to POST a malicious payload containing a rogue sharedSecret. This occurs within a time window when the integration is pending installation. The attacker can inject a false shared secret used for subsequent HMAC verification, disrupting the integrity of the Jira integration and potentially enabling further manipulation of integrated workflows. The attack requires low privileges and user interaction (likely admin-level actions to enable/install the integration). Patches are available: 11.7.1, 11.6.3, 11.5.6, and 10.11.18.

Affected products

Mattermost Mattermost Server 11.7.0, 11.6.0–11.6.2, 11.5.0–11.5.5, 10.11.0–10.11.17

Identifiers

CVE-2026-6673
GHSA-jqgv-39mg-7c2r
GO-2026-6483

Timeline

2026-06-22: disclosed
2026-06-22: patched: Patches released: 11.7.1, 11.6.3, 11.5.6, 10.11.18

References

https://mattermost.com/security-updates

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.