GO-2026-6611 vulnerabilities

Vulnerabilities for packages: prometheus-stackdriver-exporter, crossplane-provider-kubernetes-fips, cloudbeat, external-dns-fips, cloud-sql-proxy-fips, crossplane-provider-azure-eventhub, secrets-store-csi-driver-provider-aws-fips, gitlab-runner-fips, gitness, sftpgo, bank-vaults-fips,...

dr_robot

. . . . . . . : \ : \ : \ : . \ : / : . \ \ :| | | || || || : | || | \ | : | | | :| | . | || : \ | : \ | : || | | : | | | |. / | || |\ . / |/ . / | | :/ || || :/ :/ || : : : Copyright 2019 National Technology & Engineering Solutions of Sandia, LLC NTESS. Under the terms of Contract...

GO-2026-6547 Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server

Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server...

PT-2026-105569

Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server...

GO-2026-6482 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server

Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server...

GO-2026-6480 Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler in github.com/mattermost/mattermost-server

Mattermost doesn't enforce administrator authorization on the setDefaultInstance call within the /gitlab connect command handler in github.com/mattermost/mattermost-server...

GO-2026-6484 Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server

Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server...

GO-2026-6483 Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret in github.com/mattermost/mattermost-server

Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret in github.com/mattermost/mattermost-server...

GO-2026-6481 Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint in github.com/mattermost/mattermost-server

Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint in github.com/mattermost/mattermost-server...

Mattermost Server 10.11.x < 10.11.23 / 11.7.x < 11.7.8 / 11.8.x < 11.8.5 / 11.9.x < 11.9.1 Incorrect Authorization (MMSA-2026-00702)

The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2026-00702 advisory. - Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to sanitize Team objects returned by the data retention team...

Mattermost Server 11.7.x < 11.7.11 / 11.8.x < 11.8.6 / 11.9.x < 11.9.2 / 11.10.x < 11.10.2 Multiple Vulnerabilities (MMSA-2026-00771, MMSA-2026-00775, MMSA-2026-00776)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00771, MMSA-2026-00775, MMSA-2026-00776 advisories. - Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a...

CVE-2026-96260

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96259

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the...

EUVD-2026-84870

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96260

The Mattermost server is vulnerable to a denial of service because it fails to enforce a request body size limit during CSRF validation of plugin requests. This flaw allows an authenticated user to exhaust server memory by sending a large request body to a plugin endpoint. Affected versions inclu...

CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

EUVD-2026-84869

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the...

CVE-2026-96259 Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the...

CVE-2026-96259 Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the...