Is CVE-2026-9162 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9162 being exploited in the wild.

How severe is CVE-2026-9162?

Medium severity, with a CVSS score of 4.3, published 22 June 2026.

Which products and versions are affected?

github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.18+incompatible,introduced=11.5.0+incompatible,fixed=11.5.6+incompatible,introduced=11.6.0+incompatible,fixed=11.6.3+incompatible,introduced=11.7.0+incompatible,fixed=11.7.1+incompatible, SEMVER:introduced=11.7.0,fixed=11.7.1; Mattermost 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17; Mattermost Server 11.7.0, 11.6.0-11.6.2, 11.5.0-11.5.5, 10.11.0-10.11.17.

Is there a fix for CVE-2026-9162?

Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9162 attacked?

It is attacked over the network.

Am I affected by CVE-2026-9162?

Check whether you run github.com/mattermost/mattermost-server (Go), Mattermost or Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9162: Mattermost insufficient session expiration in WebSocket connections

Q: Is there a fix for CVE-2026-9162?

Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-9162 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-9162?

Check whether you run github.com/mattermost/mattermost-server (Go), Mattermost or Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9162 · Severity: medium · CVSS 4.3 · Published 2026-06-22

Mattermost is a popular team communication and collaboration platform. When an administrator revokes a user's session globally (e.g., after detecting a compromise or terminating employment), users with active WebSocket connections may remain authenticated and continue accessing real-time messages and events until their cached credentials expire or they manually reconnect. This means a compromised or terminated user account can persist in receiving sensitive team communications for an extended period despite being revoked.

Technologies: github.com/mattermost/mattermost-server (Go), Mattermost, Mattermost Server. Vendors: Go, Mattermost.

Quick answers

Is CVE-2026-9162 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9162 being exploited in the wild.
How severe is CVE-2026-9162?: Medium severity, with a CVSS score of 4.3, published 22 June 2026.
Which products and versions are affected?: github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.18+incompatible,introduced=11.5.0+incompatible,fixed=11.5.6+incompatible,introduced=11.6.0+incompatible,fixed=11.6.3+incompatible,introduced=11.7.0+incompatible,fixed=11.7.1+incompatible, SEMVER:introduced=11.7.0,fixed=11.7.1; Mattermost 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17; Mattermost Server 11.7.0, 11.6.0-11.6.2, 11.5.0-11.5.5, 10.11.0-10.11.17.
Is there a fix for CVE-2026-9162?: Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9162 attacked?: It is attacked over the network.
Am I affected by CVE-2026-9162?: Check whether you run github.com/mattermost/mattermost-server (Go), Mattermost or Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later
```
go get github.com/mattermost/mattermost-server@v11.7.1+incompatible
```

Technical details

This vulnerability is a session management flaw (CWE-613: Insufficient Session Expiration) in Mattermost's WebSocket authentication layer. When a global session revocation is triggered, the server fails to invalidate cached authentication tokens for clients maintaining persistent WebSocket connections. An attacker with an existing WebSocket connection to the Mattermost server can exploit this by maintaining that connection after their session is revoked; the server will continue to authenticate requests and deliver real-time events until either the local cache expires or the client reconnects and re-authenticates. The vulnerability requires the attacker to have had legitimate access initially (privilege level: low) and a network connection to the Mattermost server (attack vector: network). Patches are available in versions 11.7.1, 11.6.3, 11.5.6, and 10.11.18.

Affected products

Mattermost Mattermost Server 11.7.0, 11.6.0-11.6.2, 11.5.0-11.5.5, 10.11.0-10.11.17

Identifiers

CVE-2026-9162
GHSA-h998-hxxj-8q83
GO-2026-6482

Timeline

2026-06-22: disclosed: Published to GitHub Advisory Database
2026-06-22: patched: Patches released: 11.7.1, 11.6.3, 11.5.6, 10.11.18
2026-06-22: advisory: Mattermost Advisory ID: MMSA-2026-00664

References

https://mattermost.com/security-updates

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.