# CVE-2026-9162: Mattermost insufficient session expiration in WebSocket connections

Source: https://junglewise.ai/threats/cve-2026-9162-mattermost-insufficient-session-expiration-in-websocket  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-9162 · Severity: medium · CVSS 4.3 · Published 2026-06-22

Mattermost is a popular team communication and collaboration platform. When an administrator revokes a user's session globally (e.g., after detecting a compromise or terminating employment), users with active WebSocket connections may remain authenticated and continue accessing real-time messages and events until their cached credentials expire or they manually reconnect. This means a compromised or terminated user account can persist in receiving sensitive team communications for an extended period despite being revoked.

Technologies: [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server), [Mattermost](https://junglewise.ai/threats/technologies/mattermost), [Mattermost Server](https://junglewise.ai/threats/technologies/server-public). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-9162 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9162 being exploited in the wild.

**How severe is CVE-2026-9162?** Medium severity, with a CVSS score of 4.3, published 22 June 2026.

**Which products and versions are affected?** github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.18+incompatible,introduced=11.5.0+incompatible,fixed=11.5.6+incompatible,introduced=11.6.0+incompatible,fixed=11.6.3+incompatible,introduced=11.7.0+incompatible,fixed=11.7.1+incompatible, SEMVER:introduced=11.7.0,fixed=11.7.1; Mattermost 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17; Mattermost Server 11.7.0, 11.6.0-11.6.2, 11.5.0-11.5.5, 10.11.0-10.11.17.

**Is there a fix for CVE-2026-9162?** Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9162 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-9162?** Check whether you run github.com/mattermost/mattermost-server (Go), Mattermost or Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later

  ```sh
  go get github.com/mattermost/mattermost-server@v11.7.1+incompatible
  ```


## Technical details

This vulnerability is a session management flaw (CWE-613: Insufficient Session Expiration) in Mattermost's WebSocket authentication layer. When a global session revocation is triggered, the server fails to invalidate cached authentication tokens for clients maintaining persistent WebSocket connections. An attacker with an existing WebSocket connection to the Mattermost server can exploit this by maintaining that connection after their session is revoked; the server will continue to authenticate requests and deliver real-time events until either the local cache expires or the client reconnects and re-authenticates. The vulnerability requires the attacker to have had legitimate access initially (privilege level: low) and a network connection to the Mattermost server (attack vector: network). Patches are available in versions 11.7.1, 11.6.3, 11.5.6, and 10.11.18.

## Affected products

- Mattermost Mattermost Server 11.7.0, 11.6.0-11.6.2, 11.5.0-11.5.5, 10.11.0-10.11.17

## Identifiers

- CVE-2026-9162
- GHSA-h998-hxxj-8q83
- GO-2026-6482

## Timeline

- 2026-06-22: disclosed: Published to GitHub Advisory Database
- 2026-06-22: patched: Patches released: 11.7.1, 11.6.3, 11.5.6, 10.11.18
- 2026-06-22: advisory: Mattermost Advisory ID: MMSA-2026-00664

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost CSRF via Agents plugin mention reminder validation](https://junglewise.ai/threats/cve-2026-93851-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10)
- [Mattermost denial of service via PDF text extraction memory exhaustion](https://junglewise.ai/threats/cve-2026-93850-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)
- [Mattermost denial of service in WebSocket msgpack decoder](https://junglewise.ai/threats/cve-2026-93849-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)
- [Mattermost information disclosure in post deletion events](https://junglewise.ai/threats/cve-2026-19621-mattermost-versions-11-10-x-11-10-0-11-7-x-11-7-9-11-9-x-11-9-1)
- [Mattermost authentication token leak in server logs](https://junglewise.ai/threats/cve-2026-19600-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)