CVE-2026-7184: Mattermost sensitive information disclosure in Remote Cluster API

CVE-2026-7184 · Severity: medium · CVSS 6.5 · Published 2026-06-12

Mattermost is a team collaboration platform that supports connecting to remote clusters for distributed deployments. A flaw in how the product handles authentication token responses during remote cluster configuration updates allows certain privileged users to extract sensitive cluster credentials. An attacker with the appropriate administrative permission could intercept or retrieve remote cluster authentication tokens, potentially gaining unauthorized access to connected infrastructure and compromising the security of distributed Mattermost installations.

Technologies: github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go), github.com/mattermost/mattermost/server/v8 (Go), Mattermost Server. Vendors: Go, Mattermost.

Quick answers

Is CVE-2026-7184 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-7184 being exploited in the wild.
How severe is CVE-2026-7184?
Medium severity, with a CVSS score of 6.5, published 12 June 2026.
Which products and versions are affected?
github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.16+incompatible,introduced=11.5.0+incompatible,fixed=11.5.5+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=8.0.0-20250731163400-5b955468ea1e,fixed=8.0.0-20260428142921-bd8fc9222672; and 1 more.
Is there a fix for CVE-2026-7184?
Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260428142921-bd8fc9222672 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7184 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-7184?
Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later
    go get github.com/mattermost/mattermost-server@v11.6.1+incompatible
  • github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260428142921-bd8fc9222672 or later
    go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260428142921-bd8fc9222672

Technical details

This vulnerability is an information disclosure issue (CWE-201) caused by insufficient output sanitization in the Remote Cluster API PATCH endpoint. The vulnerability affects the handling of authentication token fields (Token and RemoteToken) in the API response; these sensitive credentials are returned unsanitized to authenticated callers. Exploitation requires network access to the Mattermost API and valid authentication with the manage_secure_connections permission. An attacker with this permission can issue a PATCH request to the remote cluster endpoint and extract the authentication tokens from the response, allowing them to impersonate the remote cluster connection. Patches are available in versions 11.6.2 (or 11.6.1), 11.5.5, 10.11.16, and later releases. The fix involves sanitizing the Token and RemoteToken fields before returning the response to the client.

Affected products

  • Mattermost Mattermost Server 11.6.0 to 11.6.1, 11.5.0 to 11.5.4, 10.11.0 to 10.11.15
  • Mattermost mattermost-server (Go module) 8.0.0-20250731163400-5b955468ea1e to before 8.0.0-20260428142921-bd8fc9222672

Identifiers

  • CVE-2026-7184
  • GHSA-9p44-r552-4wp9
  • GO-2026-6282

Timeline

  • 2026-06-12: disclosed: Vulnerability disclosed in GitHub Advisory GHSA-9p44-r552-4wp9
  • 2026-04-28: patched: Fix merged in PR #36288 (master branch); cherry-picked to release branches 11.7, 11.6, 11.5, and 10.11
  • 2026-06-12: other: CVE-2026-7184 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.