# Mattermost in October 2026: incidents, uptime and changes

> Mattermost in October 2026: 0 incidents on its status page (0 major or critical), 100% free of major or critical incidents (vendor-reported), 23 CVEs. From Rewindex’s archive of Mattermost’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/mattermost/2026/10
Last updated: 2026-11-02T20:18:05Z

- Incidents posted: 0 (major/critical: 0) · Maintenance: 0
- By vendor impact label: none
- Uptime (vendor-reported): 100% free of major/critical incidents, 100% free of any incident; outage time 0 min, incident time 0 min
- Price changes: 0 · Pricing/legal/trust page changes: 0 · Deprecations: 0 · CVEs: 23
- Previous month: [September 2026](https://rewindex.com/company/mattermost/2026/09.md) · Next: none · [All months](https://rewindex.com/company/mattermost/reports.md) · [Mattermost](https://rewindex.com/company/mattermost.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## All incidents

_No incidents posted this month._

## CVEs published

- [CVE-2026-19541](https://rewindex.com/cve/CVE-2026-19541.md) Outgoing OAuth connection client secret exposure during connection validation (CVSS 6.5), published 2026-10-16
- [CVE-2026-18551](https://rewindex.com/cve/CVE-2026-18551.md) Mattermost guest account privilege escalation via member roles API (CVSS 6.5), published 2026-10-16
- [CVE-2026-19601](https://rewindex.com/cve/CVE-2026-19601.md) Disclosure of AD/LDAP bind password via Test Connection (CVSS 4.9), published 2026-10-16
- [CVE-2026-19867](https://rewindex.com/cve/CVE-2026-19867.md) Uncapped mention keys in user notification properties allow CPU exhaustion during post processing (CVSS 4.3), published 2026-10-16
- [CVE-2026-18795](https://rewindex.com/cve/CVE-2026-18795.md) Missing server side validation allowed user to quarantine a DM and GM post (CVSS 6.4), published 2026-10-16
- [CVE-2026-19603](https://rewindex.com/cve/CVE-2026-19603.md) Private channel ID disclosure via user status endpoints (CVSS 4.3), published 2026-10-16
- [CVE-2026-19621](https://rewindex.com/cve/CVE-2026-19621.md) Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads (CVSS 6.5), published 2026-10-16
- [CVE-2026-19600](https://rewindex.com/cve/CVE-2026-19600.md) Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts (CVSS 4.5), published 2026-10-16
- [CVE-2026-16453](https://rewindex.com/cve/CVE-2026-16453.md) Mattermost SAML RelayState forgery allows unauthorized team membership (CVSS 7.1), published 2026-10-16
- [CVE-2026-18560](https://rewindex.com/cve/CVE-2026-18560.md) Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status (CVSS 4.3), published 2026-10-16
- [CVE-2026-19076](https://rewindex.com/cve/CVE-2026-19076.md) Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token (CVSS 4.4), published 2026-10-16
- [CVE-2026-18223](https://rewindex.com/cve/CVE-2026-18223.md) Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access (CVSS 5.0), published 2026-10-16
- [CVE-2026-18256](https://rewindex.com/cve/CVE-2026-18256.md) Private team metadata disclosure via the team search API (CVSS 4.3), published 2026-10-16
- [CVE-2026-16251](https://rewindex.com/cve/CVE-2026-16251.md) Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering (CVSS 6.5), published 2026-10-16
- [CVE-2026-18799](https://rewindex.com/cve/CVE-2026-18799.md) Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users (CVSS 4.3), published 2026-10-16
- [CVE-2026-13411](https://rewindex.com/cve/CVE-2026-13411.md) Null condition in Playbooks import crashes the plugin (CVSS 4.3), published 2026-10-22
- [CVE-2026-116516](https://rewindex.com/cve/CVE-2026-116516.md) Insufficient length validation when parsing Zoom chat transcriptions (CVSS 6.5), published 2026-10-26
- [CVE-2026-93847](https://rewindex.com/cve/CVE-2026-93847.md) Improper post type validation on scheduled post endpoints (CVSS 3.5), published 2026-10-26
- [CVE-2026-93849](https://rewindex.com/cve/CVE-2026-93849.md) Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames (CVSS 6.5), published 2026-10-26
- [CVE-2026-93850](https://rewindex.com/cve/CVE-2026-93850.md) Unbounded memory consumption during PDF text extraction (CVSS 6.5), published 2026-10-26
- [CVE-2026-93848](https://rewindex.com/cve/CVE-2026-93848.md) Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator (CVSS 2.7), published 2026-10-26
- [CVE-2026-93846](https://rewindex.com/cve/CVE-2026-93846.md) Team admin can escalate a team member's permissions via the team member roles endpoint (CVSS 3.8), published 2026-10-26
- [CVE-2026-93851](https://rewindex.com/cve/CVE-2026-93851.md) Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post (CVSS 8.0), published 2026-10-28

## Cite this

Mattermost posted 0 status incidents in October 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.

- Canonical URL: https://rewindex.com/company/mattermost/2026/10
- Citation: Mattermost, “Mattermost in October 2026” (2026-10-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/mattermost/2026/10 (CC BY 4.0).
- Markdown link: `[Mattermost: Mattermost in October 2026 (2026-10-01)](https://rewindex.com/company/mattermost/2026/10)`


---
Canonical: https://rewindex.com/company/mattermost/2026/10 · Markdown: https://rewindex.com/company/mattermost/2026/10.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-05T16:03:21.785Z