CVE-2026-13411: Null condition in Playbooks import crashes the plugin
Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks plugin instance-wide via a crafted import request containing a null condition. Mattermost Advisory ID: MMSA-2026-00709
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.10.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch MMSA-2026-00709
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker can exploit it by submitting a crafted Playbooks import request containing a null condition. No user interaction is required.
What is the impact of a successful exploit?
The crafted import can crash the Playbooks plugin instance-wide, causing an availability impact. The provided information does not indicate confidentiality or integrity impact.
Which deployments are known to be affected?
Mattermost Playbooks versions in the 11.7.x line through 11.7.11 are affected.