CVE-2026-2462
Admin RCE via Malicious Plugin Upload on CI Test Instances
CVSS Score
6.6
EPSS Score
0.0%
EPSS Percentile
0th
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to restrict plugin installation on CI test instances with default admin credentials which allows an unauthenticated attacker to achieve remote code execution and exfiltrate sensitive configuration data including AWS and SMTP credentials via uploading a malicious plugin after changing the import directory. Mattermost Advisory ID: MMSA-2025-00528
| CWE | CWE-863 |
| Vendor | mattermost |
| Product | mattermost |
| Published | Mar 16, 2026 |
| Last Updated | Mar 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for mattermost mattermost
Be the first to know when new medium vulnerabilities affecting mattermost mattermost are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
Mattermost / Mattermost
11.3.0 ≤ 11.3.0 11.2.0 ≤ 11.2.2 10.11.0 ≤ 10.11.10
Credits
daw10