# Mattermost in May 2026: incidents, uptime and changes

> Mattermost in May 2026: 0 incidents on its status page (0 major or critical), 100% free of major or critical incidents (vendor-reported), 36 CVEs. From Rewindex’s archive of Mattermost’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/mattermost/2026/05
Last updated: 2026-10-14T20:10:00Z

- Incidents posted: 0 (major/critical: 0) · Maintenance: 0
- By vendor impact label: none
- Uptime (vendor-reported): 100% free of major/critical incidents, 100% free of any incident; outage time 0 min, incident time 0 min
- Price changes: 0 · Pricing/legal/trust page changes: 0 · Deprecations: 0 · CVEs: 36
- Previous month: [April 2026](https://rewindex.com/company/mattermost/2026/04.md) · Next: [June 2026](https://rewindex.com/company/mattermost/2026/06.md) · [All months](https://rewindex.com/company/mattermost/reports.md) · [Mattermost](https://rewindex.com/company/mattermost.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## All incidents

_No incidents posted this month._

## CVEs published

- [CVE-2026-4054](https://rewindex.com/cve/CVE-2026-4054.md) SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service (CVSS 4.3), published 2026-05-15
- [CVE-2026-4053](https://rewindex.com/cve/CVE-2026-4053.md) post edit time limit is not enforced on some post update operations (CVSS 3.1), published 2026-05-15
- [CVE-2026-6334](https://rewindex.com/cve/CVE-2026-6334.md) OAuth authorization code client binding not enforced during token redemption in Mattermost (CVSS 3.1), published 2026-05-18
- [CVE-2026-28759](https://rewindex.com/cve/CVE-2026-28759.md) Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels (CVSS 4.3), published 2026-05-18
- [CVE-2026-2325](https://rewindex.com/cve/CVE-2026-2325.md) Improper Input Validation in MS Teams Meetings API Handler (CVSS 4.3), published 2026-05-18
- [CVE-2026-3637](https://rewindex.com/cve/CVE-2026-3637.md) Mattermost fails to enforce create\_post permission when editing posts (CVSS 4.3), published 2026-05-18
- [CVE-2026-4273](https://rewindex.com/cve/CVE-2026-4273.md) Insufficient token rotation validation in remote cluster invite confirmation (CVSS 3.7), published 2026-05-18
- [CVE-2026-3495](https://rewindex.com/cve/CVE-2026-3495.md) Unescaped variables during error page composition (CVSS 3.8), published 2026-05-18
- [CVE-2026-6342](https://rewindex.com/cve/CVE-2026-6342.md) Group prefix matching bypass for subscriptions (CVSS 4.3), published 2026-05-18
- [CVE-2026-6341](https://rewindex.com/cve/CVE-2026-6341.md) Incomplete group locking implementation (CVSS 4.3), published 2026-05-18
- [CVE-2026-6340](https://rewindex.com/cve/CVE-2026-6340.md) Memory Exhaustion via Malicious 7zip File Upload (CVSS 4.3), published 2026-05-18
- [CVE-2026-6339](https://rewindex.com/cve/CVE-2026-6339.md) Missing request origin validation on burn-on-read reveal endpoint (CVSS 4.3), published 2026-05-18
- [CVE-2026-4286](https://rewindex.com/cve/CVE-2026-4286.md) Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update (CVSS 3.1), published 2026-05-18
- [CVE-2026-3117](https://rewindex.com/cve/CVE-2026-3117.md) Instance and webhook GitLab plugin commands were able to be run by non-admin users (CVSS 6.5), published 2026-05-18
- [CVE-2026-5163](https://rewindex.com/cve/CVE-2026-5163.md) Missing authorization check in AI message rewrite endpoint allows access to private thread content (CVSS 6.5), published 2026-05-18
- [CVE-2026-6347](https://rewindex.com/cve/CVE-2026-6347.md) Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets (CVSS 7.6), published 2026-05-18
- [CVE-2026-6343](https://rewindex.com/cve/CVE-2026-6343.md) Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing unauthorized access to public playbooks (CVSS 4.3), published 2026-05-18
- [CVE-2026-28732](https://rewindex.com/cve/CVE-2026-28732.md) Slash command trigger-word update allowed command hijacking (CVSS 4.3), published 2026-05-18
- [CVE-2026-6346](https://rewindex.com/cve/CVE-2026-6346.md) Sensitive credentials exposed in plaintext in Mattermost support packets (CVSS 8.7), published 2026-05-18
- [CVE-2026-6345](https://rewindex.com/cve/CVE-2026-6345.md) Prevent password disclosure and force reset during Slack import (CVSS 6.5), published 2026-05-18
- [CVE-2026-6333](https://rewindex.com/cve/CVE-2026-6333.md) SSRF via Host Header Spoofing in Custom Slash Commands (CVSS 3.5), published 2026-05-18
- [CVE-2026-4643](https://rewindex.com/cve/CVE-2026-4643.md) Calling window.close() from server-side content causes crash in the Mattermost Desktop App (CVSS 3.5), published 2026-05-18
- [CVE-2026-3471](https://rewindex.com/cve/CVE-2026-3471.md) Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App (CVSS 6.5), published 2026-05-18
- [CVE-2026-4055](https://rewindex.com/cve/CVE-2026-4055.md) Insufficient permission validation on cross-team playbook run creation (CVSS 4.3), published 2026-05-21
- [CVE-2026-4858](https://rewindex.com/cve/CVE-2026-4858.md) Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token. (CVSS 8.0), published 2026-05-21
- [CVE-2026-22880](https://rewindex.com/cve/CVE-2026-22880.md) Mobile SSO authentication flow allows credential theft via malicious server (CVSS 6.1), published 2026-05-21
- [CVE-2026-5755](https://rewindex.com/cve/CVE-2026-5755.md) Denial of service via crafted TIFF file upload (CVSS 6.5), published 2026-05-22
- [CVE-2026-5308](https://rewindex.com/cve/CVE-2026-5308.md) Missing request body size limits on Zoom plugin HTTP endpoints (CVSS 4.9), published 2026-05-22
- [CVE-2026-5740](https://rewindex.com/cve/CVE-2026-5740.md) Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server (CVSS 7.5), published 2026-05-22
- [CVE-2026-3636](https://rewindex.com/cve/CVE-2026-3636.md) Sanitize team member data returned by API (CVSS 4.3), published 2026-05-22
- [CVE-2026-4646](https://rewindex.com/cve/CVE-2026-4646.md) Insufficient input validation in GitHub plugin API causes denial of service (CVSS 4.3), published 2026-05-22
- [CVE-2026-3473](https://rewindex.com/cve/CVE-2026-3473.md) Improper file ownership validation in the Boards API allows unauthorised file access (CVSS 5.9), published 2026-05-22
- [CVE-2026-4635](https://rewindex.com/cve/CVE-2026-4635.md) Persistent notification timing attack causing server denial of service (CVSS 6.5), published 2026-05-22
- [CVE-2026-28735](https://rewindex.com/cve/CVE-2026-28735.md) GitHub OAuth Scope Validation (CVSS 5.4), published 2026-05-22
- [CVE-2026-4915](https://rewindex.com/cve/CVE-2026-4915.md) Server panic via outgoing webhook responses (CVSS 6.5), published 2026-05-25
- [CVE-2026-6957](https://rewindex.com/cve/CVE-2026-6957.md) Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write. (CVSS 8.0), published 2026-05-27

## Cite this

Mattermost posted 0 status incidents in May 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.

- Canonical URL: https://rewindex.com/company/mattermost/2026/05
- Citation: Mattermost, “Mattermost in May 2026” (2026-05-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/mattermost/2026/05 (CC BY 4.0).
- Markdown link: `[Mattermost: Mattermost in May 2026 (2026-05-01)](https://rewindex.com/company/mattermost/2026/05)`


---
Canonical: https://rewindex.com/company/mattermost/2026/05 · Markdown: https://rewindex.com/company/mattermost/2026/05.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-05T16:03:19.476Z