CVE-2026-2476
Published: 16 March 2026
Summary
CVE-2026-2476 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Mattermost Ms Teams. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 13.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-15 (Information Output Filtering) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-2476 is a vulnerability in Mattermost Plugins versions <=2.0.3.0 that results from a failure to properly mask sensitive configuration values. This flaw allows an attacker with access to support packets to obtain the original plugin settings via exported configuration data. The issue is tracked under Mattermost Advisory ID MMSA-2026-00606 and carries a CVSS score of 7.6 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N), with associated CWEs CWE-200 and NVD-CWE-noinfo.
Exploitation requires high privileges (PR:H) on the affected Mattermost instance and is feasible over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). An attacker can achieve high confidentiality impact (C:H) with a changed scope (S:C), enabling the exposure of sensitive plugin configuration data, while integrity impact remains low (I:L) and availability is unaffected (A:N).
Mitigation details are available in Mattermost Advisory MMSA-2026-00606 and the security updates page at https://mattermost.com/security-updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12387
Vulnerability details
Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability exposes unmasked sensitive plugin configuration values (typically credentials/secrets) in exported support packets and configuration data, directly enabling adversaries to obtain unsecured credentials from application configuration.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring timely installation of the Mattermost security update that properly masks sensitive plugin configuration values in exported support packets.
Requires filtering and sanitization of system outputs, such as support packets, to prevent unauthorized disclosure of unmasked sensitive configuration data.
Limits high-privilege (PR:H) access necessary for an attacker to generate and exploit support packets containing sensitive plugin settings.