CVE-2026-6673

Name of the Vulnerable Software and Affected Versions Mattermost version 11.7.0 Mattermost version 11.6.2 Mattermost version 11.5.5 Mattermost version 10.11.17

Description Remote unauthenticated attackers can inject a rogue sharedSecret and disrupt the Jira integration. This occurs during the pending-install window via a POST request to the '/ac/installed' endpoint because the software fails to authenticate Atlassian Connect installed callbacks.

Recommendations Update Mattermost version 11.7.0 to a newer version. Update Mattermost version 11.6.2 to a newer version. Update Mattermost version 11.5.5 to a newer version. Update Mattermost version 10.11.17 to a newer version.