Outbound Internal-Connection Filtering Vulnerability in Mattermost Communication Platform

CVE-2026-93848

What is CVE-2026-93848?

Mattermost versions 11.7.x through 11.7.10 exhibit a vulnerability where outbound internal-connection filtering is not applied to requests made to the OpenID discovery endpoint. This flaw potentially enables a system administrator to ascertain whether internal addresses and ports can be reached from the server via unauthenticated login requests, which trigger the discovery fetch. This oversight raises concerns regarding information exposure and unauthorized network access, thereby demanding immediate attention from users of the affected versions.

References