CVE-2026-6347
published 2026-05-18CVE-2026-6347: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin…
PriorityP344high7.6CVSS 3.1
AVNACLPRHUINSCCHINAL
EPSS
0.26%
17.2th percentile
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker with access to a support packet to obtain TURN server credentials via the plaintext values present in the exported plugin configuration.. Mattermost Advisory ID: MMSA-2026-00605
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-plugin-calls | >= 0 < 1.12.0-rc2 | 1.12.0-rc2 |
| github.com | mattermost_mattermost-server | >= 10.11.0 < 10.11.14 | 10.11.14 |
| github.com | mattermost_mattermost-server | >= 11.4.0 < 11.4.4 | 11.4.4 |
| github.com | mattermost_mattermost-server | >= 11.5.0 < 11.5.2 | 11.5.2 |
| mattermost | mattermost | 10.11.0 – 10.11.13 | — |
| mattermost | mattermost | 11.4.0 – 11.4.3 | — |
| mattermost | mattermost | 11.5.0 – 11.5.1 | — |
| mattermost | mattermost_server | >= 10.11.0 < 10.11.14 | 10.11.14 |
| mattermost | mattermost_server | >= 11.4.0 < 11.4.4 | 11.4.4 |
| mattermost | mattermost_server | >= 11.5.0 < 11.5.2 | 11.5.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-82j6-4fq7-fx62: Mattermost versions 11
ghsa_unreviewed·2026-05-18
CVE-2026-6347 [HIGH] CWE-200 GHSA-82j6-4fq7-fx62: Mattermost versions 11
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker with access to a support packet to obtain TURN server credentials via the plaintext values present in the exported plugin configuration.. Mattermost Advisory ID: MMSA-2026-00605
VulDB
Mattermost up to 10.11.13/11.4.3/11.5.1 Calls Plugin plaintext information disclosure (EUVD-2026-30752)
vuldb·2026-05-18·CVSS 7.6
CVE-2026-6347 [HIGH] Mattermost up to 10.11.13/11.4.3/11.5.1 Calls Plugin plaintext information disclosure (EUVD-2026-30752)
A vulnerability classified as problematic was found in Mattermost up to 10.11.13/11.4.3/11.5.1. Affected is an unknown function of the component Calls Plugin. Executing a manipulation of the argument plaintext can lead to information disclosure.
This vulnerability is tracked as CVE-2026-6347. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is advised.
GHSA
Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin
ghsa·2026-05-18
CVE-2026-6347 [HIGH] CWE-200 Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin
Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker with access to a support packet to obtain TURN server credentials via the plaintext values present in the exported plugin configuration.. Mattermost Advisory ID: MMSA-2026-00605
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-18
Published