CVE-2026-19601

MediumCVSS 4.9/10Last modified Oct 29, 2026

Description

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature. Mattermost Advisory ID: MMSA-2026-00764

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-201

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 11.9.0, <= 11.9.1; >= 11.8.0, <= 11.8.5; >= 11.7.0, <= 11.7.10; >= 11.10.0, <= 11.10.1

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Oct 16, 2026
Last modified: Oct 29, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-196034.3Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field retu CVE-2026-196075.3A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and ac CVE-2026-196085.3A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to res CVE-2026-19618.8A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. CVE-2026-196106.5A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The CVE-2026-196117.4A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth chara CVE-2026-196125.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu CVE-2026-196136.5The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads CVE-2026-196145.3The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2 CVE-2026-196156.8The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them thro CVE-2026-196167.5Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. Thi CVE-2026-196175.5A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested s