IPv4-Mapped IPv6 Address Vulnerability in Mattermost by Mattermost

CVE-2026-2455

What is CVE-2026-2455?

Mattermost's software versions 11.3.x (up to 11.3.0), 11.2.x (up to 11.2.2), and 10.11.x (up to 10.11.10) have a significant flaw involving the failure to properly canonicalize IPv4-mapped IPv6 addresses prior to validating reserved IP addresses. This oversight can enable attackers to exploit internal services through Server-Side Request Forgery (SSRF) by injecting IPv4-mapped IPv6 literals, such as [::ffff:127.0.0.1], into the system. Organizations using the affected versions are urged to review their security measures and apply relevant patches to mitigate exposure to such attacks. For more details, refer to the official security advisory.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References