CVE-2026-9699

Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with access to server logs or support packets to obtain a valid or partially reconstructable OpenAI API key via inspection of mattermost.log entries generated during authentication failures. Mattermost Advisory ID: MMSA-2026-00609

Scoring

Severity

MEDIUM

CVSS base score

6.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

EPSS probability

0.46%

CWE

CWE-532

Published

2026-06-26

Last modified

2026-06-26

Affected products

• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost

Weakness type

• CWE-532

Related vulnerabilities

• CVE-2026-22778 — vLLM leaks a heap address when PIL throws an error
• CVE-2025-14437 — Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
• CVE-2026-5128 — A sensitive information exposure vulnerability exists in ArthurFiorette steam-trader 2.1.1. An unauthenticated attacker
• CVE-2026-25813 — PlaciPy Exposes Sensitive Data via Application Logs
• CVE-2026-23493 — Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
• CVE-2026-82434 — Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
• CVE-2026-49200 — Acer Wave 7 router: Broken Access Control
• CVE-2026-43992 — JunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter

Markdown version · Browse all CVEs