Technology · Mattermost
Mattermost Server vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 111 vulnerabilities in Mattermost Server: 0 in the last 7 days and 34 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-93851, was published on 28 October 2026. 18 vulnerabilities in the last four weeks, up 20% on the four before (15).
- Last 7 days
- 0
- Last 90 days
- 34
- Critical, all time
- 2
- Exploited in the wild
- 0
About Mattermost Server
Server Public is a library containing shared components and utilities for the Mattermost server.
Latest Mattermost Server vulnerabilities
- CVE-2026-93851: Mattermost CSRF via Agents plugin mention reminder validationhighCVSS 8
- CVE-2026-93850: Mattermost denial of service via PDF text extraction memory exhaustionmediumCVSS 6.5
- CVE-2026-93849: Mattermost denial of service in WebSocket msgpack decodermediumCVSS 6.5
- CVE-2026-19621: Mattermost information disclosure in post deletion eventsmediumCVSS 6.5EPSS 0.3%
- CVE-2026-19600: Mattermost authentication token leak in server logsmediumCVSS 4.5EPSS 0.2%
- CVE-2026-19076: Mattermost authentication bypass in OAuth account takeovermediumCVSS 4.4EPSS 0.2%
- CVE-2026-18799: Mattermost Slack import account binding privilege escalationmediumCVSS 4.3EPSS 0.1%
- CVE-2026-18560: Mattermost authorization bypass in post flag statusmediumCVSS 4.3EPSS 0.2%
- CVE-2026-18256: Mattermost information disclosure in team searchmediumCVSS 4.3EPSS 0.2%
- CVE-2026-18223: Mattermost email validation bypass in invitation tokensmediumCVSS 5EPSS 0.2%
- CVE-2026-16453: Mattermost SAML RelayState integrity verification bypasshighCVSS 7.1EPSS 0.2%
- CVE-2026-16251: Mattermost Server memory exhaustion in remote image proxymediumCVSS 6.5EPSS 0.3%
- CVE-2026-19867: Mattermost Server denial of service via oversized mention keysmediumCVSS 4.3EPSS 0.2%
- CVE-2026-19603: Mattermost information disclosure in user status APImediumCVSS 4.3EPSS 0.2%
- CVE-2026-19601: Mattermost AD/LDAP bind password exposure in system configurationmediumCVSS 4.9EPSS 0.2%
- CVE-2026-19541: Mattermost OAuth connection secret exposure via validation bypassmediumCVSS 6.5EPSS 0.2%
- CVE-2026-18795: Mattermost authorization bypass in DM/GM post quarantinemediumCVSS 6.4EPSS 0.1%
- CVE-2026-18551: Mattermost privilege escalation in guest and admin role validationmediumCVSS 6.5EPSS 0.2%
- CVE-2026-96260: Mattermost memory exhaustion in CSRF validation for plugin endpointsmediumCVSS 6.5EPSS 0.4%
- CVE-2026-96259: Mattermost internal-connection filter bypass in OAuth endpointsmediumCVSS 5.5EPSS 0.3%
- CVE-2026-95666: Mattermost denial of service via unbounded post ID arraymediumCVSS 4.3EPSS 0.4%
- CVE-2026-91181: Mattermost information disclosure in data retention teams endpointmediumCVSS 6.5EPSS 0.4%
- CVE-2026-12985: Mattermost OAuth redirect URI validation bypassmediumCVSS 6.8EPSS 0.3%
- CVE-2026-86349: Mattermost Markdown parser denial of servicemediumCVSS 4.3EPSS 0.4%
- CVE-2026-86348: Mattermost denial of service via handler panic in post-action requestmediumCVSS 4.3EPSS 0.4%
Most severe Mattermost Server vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2025-12421: GO-2025-4170 - Mattermost fails to to verify the token used during code exchange in github.com/mattermost/mattermost-servercriticalCVSS 9.9EPSS 0.4%
- CVE-2025-12419: Mattermost fails to properly validate OAuth state tokens during OpenID Connect authenticationcriticalCVSS 9.9EPSS 0.4%
- CVE-2026-7387: Mattermost privilege escalation in group syncable link and patch endpointshighCVSS 8.8EPSS 0.4%
- CVE-2026-6346: Mattermost sensitive information disclosure in support packet generationhighCVSS 8.7EPSS 0.4%
- CVE-2026-4858: Mattermost path traversal in integration action URLhighCVSS 8EPSS 0.4%
- CVE-2026-93851: Mattermost CSRF via Agents plugin mention reminder validationhighCVSS 8
- CVE-2026-6961: Mattermost path traversal in shared channel file synchighCVSS 7.6EPSS 0.4%
- CVE-2026-6347: Mattermost Calls plugin information disclosure in support packetshighCVSS 7.6EPSS 0.4%
- CVE-2026-5740: Mattermost Server denial of service via msgpack WebSocket frameshighCVSS 7.5EPSS 0.6%
- CVE-2026-5308: Mattermost denial of service in plugin HTTP endpointshighCVSS 7.5EPSS 0.4%
Vulnerabilities per week
18 vulnerabilities in the last four weeks, up 20% on the four before (15). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 1 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 12 | 0 | |
| 21 Sep 2026 | 3 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 15 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 3 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Mattermost Server vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/server-public)<a href="https://junglewise.ai/threats/technologies/server-public"><img src="https://junglewise.ai/threats/technologies/server-public/badge.svg" alt="Mattermost Server vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/server-public.json, and this page as text at https://junglewise.ai/threats/technologies/server-public.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Mattermost Server vulnerabilities", https://junglewise.ai/threats/technologies/server-public, 12 November 2026.