Live › vulnerability › CVE-2026-93848
Go to dashboardMattermost 11.7.x up to 11.7.10 does not apply its outbound internal-connection filter to the OpenID discovery request. A system administrator can use unauthenticated login attempts to learn which internal addresses and ports the server can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Self-hosted Mattermost servers running 11.7.x up to 11.7.10 are affected, most relevant where OpenID login is configured. The flaw requires an administrator role to exploit, so teams with few administrators face lower risk. Managed Mattermost Cloud instances are handled by the vendor.
No product ranges from the sources yet.
mattermost version or the System Console version page; affected range is 11.7.0 through 11.7.10.11.7.10 (exact fixed version: unknown, see MMSA-2026-00774).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request which allows a System Administrator to determine whether internal addresses and ports are reachable from the server via an unauthenticated login request that triggers the discovery fetch.. Mattermost Advisory ID: MMSA-2026-00774
This page as .md · .json · in your agent: get_signal("CVE-2026-93848")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.