CVE-2026-7184

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.6.x through 11.6.1 Mattermost versions 11.5.x through 11.5.4 Mattermost versions 10.11.x through 10.11.15

Description Insufficient sanitization of the Remote Cluster API response during PATCH operations allows authenticated users possessing the manage secure connections permission to obtain remote cluster authentication tokens. This occurs when a PATCH request is sent to the remote cluster endpoint.

Recommendations Update versions 11.6.x through 11.6.1 to a newer version. Update versions 11.5.x through 11.5.4 to a newer version. Update versions 10.11.x through 10.11.15 to a newer version.