Multiple vulnerabilities in Mattermost Server (June 29, 2026)
Multiple vulnerabilities have been discovered in Mattermost Server. They allow an attacker to cause an unspecified security issue by the vendor.
CSIRTS triage
- What
- Multiple vulnerabilities have been discovered in Mattermost Server.
- Who is affected
- Users of Mattermost Server, specifics not detailed in the advisory.
- Urgency
- Remediation is necessary as the nature of the vulnerabilities is unspecified but could pose risks.
- Action
- Update Mattermost Server to the latest version to ensure vulnerabilities are addressed.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Mattermost Server
Get an email when a new Mattermost Server advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0813/
Recent advisories for Mattermost Server
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- highCVE-2026-71366: A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification back…nvd · 2026-08-24
- highCVE-2026-9816: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate Bo…nvd · 2026-08-17
- medium[NEW] [medium] Mattermost Server: Multiple vulnerabilities enable unspecified attackcert-bund · 2026-08-14
- medium[UPDATE] [medium] Mattermost Server: Multiple vulnerabilitiescert-bund · 2026-07-28
- mediumCVE-2026-10600: Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 …nvd · 2026-07-27
- unknownMultiple vulnerabilities in Mattermost Server (July 20, 2026)cert-fr-avis · 2026-07-20
More from CERT-FR Avis de sécurité
- unknownMultiple vulnerabilities in Keycloak (August 25, 2026)2026-08-25
- unknownMultiple vulnerabilities in Cisco IOS XE (August 25, 2026)2026-08-25
- unknownMultiple vulnerabilities in LibreNMS (August 24, 2026)2026-08-24
- unknownMultiple vulnerabilities in Metabase (August 24, 2026)2026-08-24
- unknownVulnerability in SPIP (August 21, 2026)2026-08-21