CompaniesMattermostMonthly reportsOctober 2026
Mattermost in October 2026: incidents, uptime and changes
0incidents posted
0labelled major or critical
100%free of major/critical
100%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 0 min, incident time 0 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
Incidents 0
Mattermost posted no incidents in October 2026.
CVEs published
- CVE-2026-19541 Outgoing OAuth connection client secret exposure during connection validation (CVSS 6.5)
- CVE-2026-18551 Mattermost guest account privilege escalation via member roles API (CVSS 6.5)
- CVE-2026-19601 Disclosure of AD/LDAP bind password via Test Connection (CVSS 4.9)
- CVE-2026-19867 Uncapped mention keys in user notification properties allow CPU exhaustion during post processing (CVSS 4.3)
- CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post (CVSS 6.4)
- CVE-2026-19603 Private channel ID disclosure via user status endpoints (CVSS 4.3)
- CVE-2026-19621 Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads (CVSS 6.5)
- CVE-2026-19600 Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts (CVSS 4.5)
- CVE-2026-16453 Mattermost SAML RelayState forgery allows unauthorized team membership (CVSS 7.1)
- CVE-2026-18560 Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status (CVSS 4.3)
- CVE-2026-19076 Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token (CVSS 4.4)
- CVE-2026-18223 Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access (CVSS 5.0)
- CVE-2026-18256 Private team metadata disclosure via the team search API (CVSS 4.3)
- CVE-2026-16251 Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering (CVSS 6.5)
- CVE-2026-18799 Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users (CVSS 4.3)
- CVE-2026-13411 Null condition in Playbooks import crashes the plugin (CVSS 4.3)
- CVE-2026-116516 Insufficient length validation when parsing Zoom chat transcriptions (CVSS 6.5)
- CVE-2026-93847 Improper post type validation on scheduled post endpoints (CVSS 3.5)
- CVE-2026-93849 Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames (CVSS 6.5)
- CVE-2026-93850 Unbounded memory consumption during PDF text extraction (CVSS 6.5)
- CVE-2026-93848 Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator (CVSS 2.7)
- CVE-2026-93846 Team admin can escalate a team member's permissions via the team member roles endpoint (CVSS 3.8)
- CVE-2026-93851 Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post (CVSS 8.0)
Cite this
Mattermost posted 0 status incidents in October 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- Mattermost in October 2026
- Vendor
- Mattermost
- Date
- URL
- https://rewindex.com/company/mattermost/2026/10