CVE-2026-7184
Received Received - Intake
Remote Cluster Token Exposure in Mattermost

Publication date: 2026-06-12

Last updated on: 2026-06-12

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the {{manage_secure_connections}} permission to obtain remote cluster authentication tokens via a PATCH request to the remote cluster endpoint.. Mattermost Advisory ID: MMSA-2026-00662
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-12
Last Modified
2026-06-12
Generated
2026-06-12
AI Q&A
2026-06-12
EPSS Evaluated
N/A
NVD
CVE-2026-7184
EUVD
EUVD-2026-36500
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
mattermost mattermost to 11.6.1 (inc)
mattermost mattermost to 11.5.4 (inc)
mattermost mattermost to 10.11.15 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects certain versions of Mattermost (11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.15). It occurs because the software fails to properly sanitize the Remote Cluster API response during PATCH operations. As a result, authenticated users who have the {{manage_secure_connections}} permission can exploit this flaw to obtain remote cluster authentication tokens by sending a PATCH request to the remote cluster endpoint.

Impact Analysis

The vulnerability allows authenticated users with specific permissions to retrieve remote cluster authentication tokens. This could lead to unauthorized access to remote clusters, potentially compromising the security of connected systems or data. Since the CVSS base score is 6.5 with a high confidentiality impact, it indicates a significant risk of sensitive information disclosure without affecting integrity or availability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart