Vulnerability · Published Mar 16, 2026 · Assigned by Mattermost

CVE-2026-2462Admin RCE via Malicious Plugin Upload on CI Test Instances

Medium 6.6

In plain English

A medium-severity incorrect authorization in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)0.3%top 71.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to restrict plugin installation on CI test instances with default admin credentials which allows an unauthenticated attacker to achieve remote code execution and exfiltrate sensitive configuration data including AWS and SMTP credentials via uploading a malicious plugin after changing the import directory. Mattermost Advisory ID: MMSA-2025-00528

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Mattermost	11.3.0 – through 11.3.011.2.0 – through 11.2.210.11.0 – through 10.11.10

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

References

MMSA-2025-00528 vendor-advisory