CVE-2026-6347highCWE-200

Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.6epss 0.3%

probabilidade de exploração

0.3%top 82% das CVEs

exploração observada

nãonenhuma fonte reporta

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker with access to a support packet to obtain TURN server credentials via the plaintext values present in the exported plugin configuration.. Mattermost Advisory ID: MMSA-2026-00605

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Produtos afetados

Mattermost · Mattermost

Referências

https://mattermost.com/security-updates