---
id: "CVE-2026-19600"
kind: "vulnerability"
aliases: ["CVE-2026-19600"]
title: "Mattermost: session and OAuth tokens written to debug logs"
severity: "medium"
cvss: 4.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["logging", "mattermost", "package", "self-hosted"]
not_affected_if: ["default-config", "patched-version"]
published_at: "2026-10-16T08:17:13+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:35:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19600", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Mattermost: session and OAuth tokens written to debug logs

Several Mattermost server versions write authentication tokens into debug-level server log entries without sanitizing them. Anyone who can read those logs can take valid session or OAuth tokens and impersonate logged-in users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `mmctl version` or check the server version under System Console to compare against the affected ranges: 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, 11.10.x up to 11.10.1.
- Check whether the log level is set to DEBUG in the server config (`LogSettings.ConsoleLevel` or `FileLevel`) and whether logs are shipped to a shared location.

## Fix

- Upgrade Mattermost to a fixed release: a version newer than 11.7.10, 11.8.5, 11.9.1 or 11.10.1 on the matching branch (exact fixed version: unknown in sources).
- Until upgraded, set log level above DEBUG, and rotate session tokens and OAuth access tokens for users if debug logs were exposed.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19600

## From the sources

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_