CVE-2026-19601
Awaiting Analysis Awaiting Analysis - Queue

Stored AD/LDAP Bind Password Disclosure in Mattermost

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature. Mattermost Advisory ID: MMSA-2026-00764

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-19601
EUVD
EUVD-2026-102807

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Mattermost Mattermost 11.9.0
Mattermost Mattermost 11.8.0
Mattermost Mattermost 11.7.0
Mattermost Mattermost 11.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mattermost versions between 11.7.x and 11.10.x fail to clear the stored AD/LDAP bind password when connection settings like server address are modified. This allows a System Console admin to expose the plaintext bind password via the Test Connection feature to an attacker-controlled server.

Detection Guidance

Check Mattermost server logs for suspicious Test Connection requests to unauthorized LDAP/AD servers. Review System Console audit logs for changes to LDAP/AD connection settings. Inspect network traffic from Mattermost servers to unexpected external LDAP/AD endpoints.

Impact Analysis

An attacker could gain access to the plaintext AD/LDAP bind password, potentially allowing unauthorized access to directory services or user authentication systems if the password is reused or has sufficient privileges.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to the exposure of plaintext AD/LDAP bind passwords. Unauthorized disclosure of credentials may lead to unauthorized access to sensitive data, which is a violation of data protection requirements under these regulations.

Mitigation Strategies

Upgrade Mattermost to a patched version (11.7.11, 11.8.6, 11.9.2, or 11.10.2). Rotate all LDAP/AD bind passwords immediately after upgrade. Disable the Test Connection feature if not required. Monitor for unauthorized LDAP/AD server connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19601. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart