Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763
CVE-2026-19600
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-19600
Mattermost
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Mattermost",
"product": "Mattermost",
"versions": [
{
"status": "affected",
"version": "11.9.0",
"versionType": "semver",
"lessThanOrEqual": "11.9.1"
},
{
"status": "affected",
"version": "11.8.0",
"versionType": "semver",
"lessThanOrEqual": "11.8.5"
},
{
"status": "affected",
"version": "11.7.0",
"versionType": "semver",
"lessThanOrEqual": "11.7.10"
},
{
"status": "affected",
"version": "11.10.0",
"versionType": "semver",
"lessThanOrEqual": "11.10.1"
},
{
"status": "unaffected",
"version": "11.11.0"
},
{
"status": "unaffected",
"version": "11.9.2"
},
{
"status": "unaffected",
"version": "11.8.6"
},
{
"status": "unaffected",
"version": "11.7.11"
},
{
"status": "unaffected",
"version": "11.10.2"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-19600
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #32411 · Revision 1
- Added to Heist Feed
- Publisher date