CVE-2026-3108
published 2026-03-26CVE-2026-3108: Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl…
PriorityP354high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.28%
20.7th percentile
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking.. Mattermost Advisory ID: MMSA-2026-00599
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost_server_v8 | >= 10.11.0-rc1 < 10.11.11 | 10.11.11 |
| github.com | mattermost_mattermost_server_v8 | >= 11.2.0-rc1 < 11.2.3 | 11.2.3 |
| github.com | mattermost_mattermost_server_v8 | >= 11.3.0-rc1 < 11.3.2 | 11.3.2 |
| github.com | mattermost_mattermost_server_v8 | >= 11.4.0-rc1 < 11.4.1 | 11.4.1 |
| github.com | mattermost_mattermost_server_v8 | >= 8.0.0-20260105080200-d27a2195068d < 8.0.0-20260217110922-b7d4a1f1f59b | 8.0.0-20260217110922-b7d4a1f1f59b |
| mattermost | mattermost | 10.11.0 – 10.11.10 | — |
| mattermost | mattermost | 11.2.0 – 11.2.2 | — |
| mattermost | mattermost | 11.3.0 – 11.3.1 | — |
| mattermost | mattermost | 11.4.0 – 11.4.0 | — |
| mattermost | mattermost_server | — | — |
| mattermost | mattermost_server | >= 10.11.0 < 10.11.11 | 10.11.11 |
| mattermost | mattermost_server | >= 11.2.0 < 11.2.3 | 11.2.3 |
| mattermost | mattermost_server | >= 11.3.0 < 11.3.2 | 11.3.2 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences
ghsa·2026-03-26
CVE-2026-3108 [HIGH] CWE-150 Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences
Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking. Mattermost Advisory ID: MMSA-2026-00599.
OSV
Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences
osv·2026-03-26
CVE-2026-3108 [HIGH] Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences
Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking. Mattermost Advisory ID: MMSA-2026-00599.
Red Hat
kernel: wifi: cfg80211: check IP header size in cfg80211_classify8021d()
vendor_redhat·2026-10-06·CVSS 5.5
CVE-2026-98345 [LOW] CWE-908 kernel: wifi: cfg80211: check IP header size in cfg80211_classify8021d()
kernel: wifi: cfg80211: check IP header size in cfg80211_classify8021d()
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: check IP header size in cfg80211_classify8021d()
A frame that looks like IP can be transmitted, but be too short, so
the DS field is read incorrectly:
BUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027
cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027
ieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180
__ieee80211_subif_start_xmit+0x60f/0x1d90 net/mac80211/tx.c:4304
ieee80211_subif_start_xmit+0xa8/0x6d0 net/mac80211/tx.c:4538
...
packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108
Use skb_header_pointer() like the MPLS case.
A flaw was found in the Linux kernel's cfg80211 wi
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-3108 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.0
CVE-2026-3108 [HIGH] CVE-2026-3108 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-3108 :
vulnerability analysis and mitigation
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking.. Mattermost Advisory ID: MMSA-2026-00599
Source : NVD
## 8.8
Score
Published March 26, 2026
Severity HIGH
CNA Score 8.0
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 12.7
Exploitation Probability (EPSS) N/A
Affected packages and libraries
github.com/mattermost/
Bugzilla
CVE-2026-98345 kernel: wifi: cfg80211: check IP header size in cfg80211_classify8021d()
bugzilla·2026-10-06
CVE-2026-98345 [LOW] CVE-2026-98345 kernel: wifi: cfg80211: check IP header size in cfg80211_classify8021d()
CVE-2026-98345 kernel: wifi: cfg80211: check IP header size in cfg80211_classify8021d()
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: check IP header size in cfg80211_classify8021d()
A frame that looks like IP can be transmitted, but be too short, so
the DS field is read incorrectly:
BUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027
cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027
ieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180
__ieee80211_subif_start_xmit+0x60f/0x1d90 net/mac80211/tx.c:4304
ieee80211_subif_start_xmit+0xa8/0x6d0 net/mac80211/tx.c:4538
...
packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108
Use skb_header_pointer() like the MPLS case.
Discussion:
Upstream advisory:
2026-03-26
Published