CVE-2026-3108
Mattermost Server 10.11.0 – 10.11.11
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-3108 is a high-severity Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150) vulnerability in Mattermost Mattermost Server. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-3108 affects Mattermost versions 11.2.x up to and including 11.2.2, 10.11.x up to and including 10.11.10, 11.4.x up to and including 11.4.0, and 11.3.x up to and including 11.3.1. The vulnerability stems from a failure to sanitize user-controlled post content in the terminal output of mmctl commands. This allows attackers to inject crafted messages containing ANSI and OSC escape sequences, enabling manipulation of administrator terminals through screen control, fake prompts, and clipboard hijacking. The issue is classified under CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences) with a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).
Exploitation requires an attacker with low privileges (PR:L), such as an authenticated user, to craft a malicious post that an administrator views via mmctl command output in a terminal. The attack is network-accessible (AV:N) but demands high attack complexity (AC:H) and user interaction (UI:R) from the administrator running the command. Successful exploitation grants high-impact privileges across confidentiality, integrity, and availability (C:I:A:H) with a scope change (S:C), allowing terminal takeover on the administrator's system.
For mitigation details, refer to Mattermost Advisory MMSA-2026-00599 available at https://mattermost.com/security-updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16234
Vulnerability Data
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC…
more
escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking.. Mattermost Advisory ID: MMSA-2026-00599
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.10V1.3.12
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation/sanitization of inputs that directly stops escape/meta/control sequences from reaching downstream components.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and escaping to prevent this class of flaw.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle mandates input validation and output encoding that directly neutralizes escape/meta sequences.
Application security requirements explicitly call for controls against injection and malformed input sequences.
Secure architecture principles reduce attack surface but do not prescribe specific neutralization techniques.
Secure coding standards require proper escaping and neutralization of control characters before downstream processing.
Security testing can detect the weakness but does not itself implement neutralization.