{"id":"CVE-2026-93848","kind":"vulnerability","aliases":["CVE-2026-93848"],"related":[],"title":"Mattermost: OpenID discovery skips internal-address filtering, leaking reachability","description":"Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request which allows a System Administrator to determine whether internal addresses and ports are reachable from the server via an unauthenticated login request that triggers the discovery fetch.. Mattermost Advisory ID: MMSA-2026-00774","summary":"Mattermost 11.7.x up to 11.7.10 does not apply its outbound internal-connection filter to the OpenID discovery request. A system administrator can use unauthenticated login attempts to learn which internal addresses and ports the server can reach.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mattermost","package","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"- Check the running Mattermost server version with `mattermost version` or the System Console version page; affected range is `11.7.0` through `11.7.10`.\n- Confirm whether OpenID/GitLab-style login is configured in the System Console under Authentication.","fix":"- Upgrade Mattermost to a version newer than `11.7.10` (exact fixed version: unknown, see MMSA-2026-00774).","status":"open","published_at":"2026-10-26T15:16:46+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:03:58+00:00","updated_at":"2026-10-26T16:03:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T16:03:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mattermost to a version newer than `11.7.10` (exact fixed version: unknown, see MMSA-2026-00774).","reach":"network","title":"Mattermost: OpenID discovery skips internal-address filtering, leaking reachability","impact":"low","summary":"Mattermost 11.7.x up to 11.7.10 does not apply its outbound internal-connection filter to the OpenID discovery request. A system administrator can use unauthenticated login attempts to learn which internal addresses and ports the server can reach.","category":"package","nicknames":[],"who_cares":["mattermost","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Admin maps internal network reachability of the server","analyst_note":"","how_to_check":"- Check the running Mattermost server version with `mattermost version` or the System Console version page; affected range is `11.7.0` through `11.7.10`.\n- Confirm whether OpenID/GitLab-style login is configured in the System Console under Authentication.","needs_analyst":false,"not_affected_if":["managed-hosting","default-config"],"who_is_affected":"Self-hosted Mattermost servers running 11.7.x up to 11.7.10 are affected, most relevant where OpenID login is configured. The flaw requires an administrator role to exploit, so teams with few administrators face lower risk. Managed Mattermost Cloud instances are handled by the vendor.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000602,"input_tokens":3353,"output_tokens":533,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-00774':113C '-2026':12A,15A,112C '-93848':13A,16A '..':107C '11.7':23B,63C '11.7.10':27B,65C 'address':7A,54B,89C 'administr':44B,84C 'advisori':109C 'allow':81C 'appli':30B,68C 'attempt':49B 'connect':35B,72C 'cve':11A,14A 'determin':86C 'discoveri':3A,40B,77C,105C 'endpoint':78C 'fail':66C 'fetch':106C 'filter':8A,36B,73C 'host':21B 'id':110C 'intern':6A,34B,53B,71C,88C 'internal-address':5A 'internal-connect':33B,70C 'leak':9A 'learn':51B 'login':48B,100C 'mattermost':1A,17B,22B,61C,108C 'mmsa':111C 'openid':2A,39B,76C 'outbound':32B,69C 'packag':18B 'port':56B,91C 'reach':60B 'reachabl':10A,93C 'request':41B,79C,101C 'self':20B 'self-host':19B 'server':58B,96C 'skip':4A 'system':43B,83C 'trigger':103C 'unauthent':47B,99C 'use':46B 'version':62C 'via':97C 'whether':87C 'x':24B,64C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Mattermost servers running 11.7.x up to 11.7.10 are affected, most relevant where OpenID login is configured. The flaw requires an administrator role to exploit, so teams with few administrators face lower risk. Managed Mattermost Cloud instances are handled by the vendor.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cvss_by":"responsibledisclosure@mattermost.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93848","severity":null,"published_at":"2026-10-26T15:16:46+00:00","modified_at":"2026-10-26T15:16:46+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}