CVE-2026-9699mediumCWE-532

CVE-2026-9699: medium-severity vulnerability in Mattermost

Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors

Published

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.5%
exploitation probability
0.5%top 62% of all CVEs
observed exploitation
nono source reports it
Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with access to server logs or support packets to obtain a valid or partially reconstructable OpenAI API key via inspection of mattermost.log entries generated during authentication failures. Mattermost Advisory ID: MMSA-2026-00609
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Affected products
Mattermost · Mattermost
Related CVEs — Mattermost

In the same product, most dangerous first.

CVE-2025-25279CRITICALArbitrary file read in Mattermost Boards via import & export board archiveEPSS 24.2%CVE-2021-37859HIGHReflected XSS in OAuth FlowEPSS 3.3%CVE-2022-3257LOWServer-side Denial of Service while processing a specifically crafted GIF fileEPSS 1.3%CVE-2022-4044MEDIUMAuthenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost serverEPSS 1.1%CVE-2022-3147LOWServer-side Denial of Service while processing a specifically crafted JPEG fileEPSS 1.0%CVE-2022-1982MEDIUMA crafted SVG attachment can crash a Mattermost serverEPSS 0.9%
References
https://mattermost.com/security-updates