CVE-2026-19600
Received Received - Intake

Authentication Token Exposure in Mattermost Server Logs

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-19600
EUVD
EUVD-2026-102744

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Mattermost Mattermost 11.9.0
Mattermost Mattermost 11.8.0
Mattermost Mattermost 11.7.0
Mattermost Mattermost 11.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mattermost versions between 11.7.x and 11.10.x (specifically <= 11.9.1, <= 11.8.5, <= 11.7.10, <= 11.10.1) fail to sanitize authentication tokens before writing them to server logs. This means sensitive session or OAuth tokens are logged in plaintext at debug level, allowing attackers with log access to steal tokens and impersonate users.

Detection Guidance

Check Mattermost server logs for debug-level entries containing authentication tokens. Search logs for patterns like 'token', 'session', or 'oauth' in debug logs. Verify if tokens appear in plaintext in log files.

Impact Analysis

If you use a vulnerable Mattermost version, an attacker with access to server logs could obtain your session or OAuth tokens. This would let them log in as you, access your account, and perform actions on your behalf without needing your password.

Mitigation Strategies

Upgrade Mattermost to a patched version (11.9.2 or later, 11.8.6 or later, 11.7.11 or later, 11.10.2 or later). Review and sanitize existing logs to remove any exposed tokens. Rotate all authentication tokens and OAuth access tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart