# CVE-2026-4339: SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server

> CVE-2026-4339: SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-4339
Last updated: 2026-06-29T19:26:34Z

- Published: 2026-06-26 14:44 UTC · Updated: 2026-06-29 19:26 UTC · Assigner: Mattermost
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- EPSS: 0.14%, 3th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-918

## Description

Mattermost versions 10.11.x \<= 10.11.18, 11.6.x \<= 11.6.3, 11.5.x \<= 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the Mattermost Agents plugin MCP server which allows an attacker with access to the MCP server in stdio mode to perform server-side request forgery (SSRF) and exfiltrate data from internal network services via supplying internal URLs as file attachments in post creation requests.. Mattermost Advisory ID: MMSA-2026-00635

## Affected vendors and products

- Mattermost: Mattermost

## Tracked companies

- [Mattermost](https://rewindex.com/company/mattermost.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-4339)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-4339)
- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-4339 · Markdown: https://rewindex.com/cve/CVE-2026-4339.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-4339 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:50:05.449Z