Skip to content
CVE PROGRAM SOURCE RECORD6.6 Medium

CVE-2026-2462

Admin RCE via Malicious Plugin Upload on CI Test Instances

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to restrict plugin installation on CI test instances with default admin credentials which allows an unauthenticated attacker to achieve remote code execution and exfiltrate sensitive configuration data including AWS and SMTP credentials via uploading a malicious plugin after changing the import directory. Mattermost Advisory ID: MMSA-2025-00528

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 11.3.0 to ≤ 11.3.0affected
  • 11.2.0 to ≤ 11.2.2affected
  • 10.11.0 to ≤ 10.11.10affected
  • 11.4.0unaffected
  • 11.3.1unaffected
  • 11.2.3unaffected
  • 10.11.11unaffected

References