Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation which allows an attacker to perform SSRF attacks against internal services via IPv4-mapped IPv6 literals (e.g., [::ffff:127.0.0.1]).. Mattermost Advisory ID: MMSA-2026-00585
References
| Link | Resource |
|---|---|
| https://mattermost.com/security-updates | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
18 Mar 2026, 13:55
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mattermost
Mattermost mattermost Server |
|
| References | () https://mattermost.com/security-updates - Vendor Advisory | |
| CPE | cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* |
16 Mar 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-16 15:16
Updated : 2026-03-18 13:55
NVD link : CVE-2026-2455
Mitre link : CVE-2026-2455
CVE.ORG link : CVE-2026-2455
JSON object : View
Products Affected
mattermost
- mattermost_server
CWE
CWE-918
Server-Side Request Forgery (SSRF)