Live › vulnerability › CVE-2026-19600
Go to dashboardSeveral Mattermost server versions write authentication tokens into debug-level server log entries without sanitizing them. Anyone who can read those logs can take valid session or OAuth tokens and impersonate logged-in users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Mattermost servers running one of the listed affected versions, especially with debug logging enabled or logs readable by other staff, log aggregators, or tools. Servers on a version outside the listed ranges, or running without debug logging and with tightly restricted log access, face lower exposure. The sources do not name a managed-hosting status.
No product ranges from the sources yet.
mmctl version or check the server version under System Console to compare against the affected ranges: 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, 11.10.x up to 11.10.1.LogSettings.ConsoleLevel or FileLevel) and whether logs are shipped to a shared location.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763
This page as .md · .json · in your agent: get_signal("CVE-2026-19600")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.