CVE-2026-2476

Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606

Score

CVSS 3.1 7.6 High

Status

Analyzed - responsibledisclosure@mattermost.com

Published

2026-03-16

Last modified

2026-03-16

Weaknesses

CWE-200

Affected products

• Mattermost (Mattermost)
• Ms Teams (Mattermost)

References

• https://mattermost.com/security-updates