CVE-2026-2455

Description

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation which allows an attacker to perform SSRF attacks against internal services via IPv4-mapped IPv6 literals (e.g., [::ffff:127.0.0.1]).. Mattermost Advisory ID: MMSA-2026-00585

CVSS Metrics

• v3.1•MEDIUM•Score: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS Trends

Current EPSS score: 0.04%• Percentile: 12%

Techniques & Countermeasures

• CWE-918•Server-Side Request Forgery (SSRF)

  The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected Systems

• github.com/mattermost•mattermost-server

  ≥ 11.3.0-rc1+incompatible, < 11.3.1+incompatible | < 5.3.2-0.20260129133647-5d787969c2d5 | ≥ 10.11.0-rc1, < 10.11.11 | ≥ 11.2.0-rc1, < 11.2.3 | ≥ 11.3.0-rc1, < 11.3.1

• github.com/mattermost/mattermost-server•v5

  all

• github.com/mattermost/mattermost-server•v6

  all

• github.com/mattermost/mattermost/server•v8

  < 8.0.0-20260129133647-5d787969c2d5

• mattermost•mattermost

  11.3.0 | ≥ 11.2.0, ≤ 11.2.2 | ≥ 10.11.0, ≤ 10.11.10

• mattermost•mattermost_server

  ≥ 10.11.0, < 10.11.11 | ≥ 11.2.0, < 11.2.3 | ≥ 11.3.0, < 11.3.1

References (5)

• https://mattermost.com/security-updates
• https://nvd.nist.gov/vuln/detail/CVE-2026-2455
• https://github.com/mattermost/mattermost/commit/5d787969c2d5ab591a9dcd61b0810475eed7a646
• https://github.com/mattermost/mattermost
• https://github.com/advisories/GHSA-gqv7-j2j8-qmwq