Live › vulnerability › CVE-2026-19601
Go to dashboardMattermost keeps the AD/LDAP bind password after other connection settings, such as the server address, are changed. A System Console administrator can then use Test Connection to send that plaintext password to a server they control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Mattermost deployments on the listed affected versions that use AD/LDAP login with a bind account. The attacker must already hold a System Console administrator role. Teams on managed hosting, unaffected versions, or without AD/LDAP can skip it.
No product ranges from the sources yet.
mattermost version or the System Console version page; affected lines are 11.7.x up to 11.7.10, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, and 11.10.x up to 11.10.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature. Mattermost Advisory ID: MMSA-2026-00764
This page as .md · .json · in your agent: get_signal("CVE-2026-19601")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.