Mattermost Support Packet Vulnerability Allowing Exposure of Sensitive Credentials

A vulnerability exists in Mattermost versions 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3. These versions fail to properly sanitize sensitive configuration fields before including them in support packets generated through the System Console. As a result, a Mattermost System Admin or anyone with access to a support packet can download it and obtain sensitive credentials in plaintext. This issue is documented in the Mattermost Advisory ID: MMSA-2026-00607.

Impact

Exploitation of this vulnerability allows for the unauthorized disclosure of sensitive credentials in plaintext, potentially leading to unauthorized access or actions within the Mattermost system.

Remediation

Users can upgrade to Mattermost versions 11.7.0, 11.6.1, or 10.11.16 to address this vulnerability.