Live › vulnerability › CVE-2026-13411
Go to dashboardMattermost versions 11.7.x up to 11.7.11 fail to validate null elements when decoding playbook import conditions. An authenticated user can send a crafted import request with a null condition and crash the Playbooks plugin for the whole instance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Mattermost deployments running 11.7.x up to 11.7.11 with the Playbooks plugin enabled are exposed. An attacker needs a valid account on the instance, so teams with open or public sign-up face more risk. Teams on managed hosting or without the Playbooks plugin can skip it.
No product ranges from the sources yet.
mattermost version or the System Console and see whether it falls in 11.7.x up to 11.7.11.11.7.11 that includes the MMSA-2026-00709 fix (exact fixed version unknown from sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks plugin instance-wide via a crafted import request containing a null condition. Mattermost Advisory ID: MMSA-2026-00709
This page as .md · .json · in your agent: get_signal("CVE-2026-13411")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.