CVE-2026-7184

Analyzed Analyzed - Analysis Complete

Remote Cluster Token Exposure in Mattermost

Publication date: 2026-06-12

Last updated on: 2026-06-18

Assigner: Mattermost, Inc.

Description

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the {{manage_secure_connections}} permission to obtain remote cluster authentication tokens via a PATCH request to the remote cluster endpoint.. Mattermost Advisory ID: MMSA-2026-00662

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-18

Generated

2026-07-03

AI Q&A

2026-06-12

EPSS Evaluated

2026-07-01

NVD

CVE-2026-7184

EUVD

EUVD-2026-36500

Affected Vendors & Products

Vendor	Product	Version / Range
mattermost	mattermost_server	From 10.11.0 (inc) to 10.11.17 (exc)
mattermost	mattermost_server	From 11.5.0 (inc) to 11.5.5 (exc)
mattermost	mattermost_server	From 11.6.0 (inc) to 11.6.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Compliance Impact

The vulnerability allows authenticated users with specific permissions to obtain remote cluster authentication tokens due to failure to sanitize API responses. This exposure of authentication tokens could potentially lead to unauthorized access to sensitive data or systems.

Such unauthorized access risks may impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls over access to sensitive information and authentication credentials.

However, the provided information does not explicitly state the direct effects on compliance with these standards.

Executive Summary

This vulnerability affects certain versions of Mattermost (11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.15). It occurs because the software fails to properly sanitize the Remote Cluster API response during PATCH operations. As a result, authenticated users who have the {{manage_secure_connections}} permission can exploit this flaw to obtain remote cluster authentication tokens by sending a PATCH request to the remote cluster endpoint.

Impact Analysis

The vulnerability allows authenticated users with specific permissions to retrieve remote cluster authentication tokens. This could lead to unauthorized access to remote clusters, potentially compromising the security of connected systems or data. Since the CVSS base score is 6.5 with a high confidentiality impact, it indicates a significant risk of sensitive information disclosure without affecting integrity or availability.

Mitigation Strategies

To mitigate this vulnerability, you should update Mattermost to a version later than the affected versions (11.6.1, 11.5.4, 10.11.15) where the issue has been fixed.

Additionally, monitor the official Mattermost Security Updates page for any patches or advisories related to this vulnerability.

Hi! I’m here to help you understand CVE-2026-7184. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70