CVE-2026-19541: Outgoing OAuth connection client secret exposure during connection validation

Q: Who can exploit this issue?

An attacker must be authenticated and have permission to manage outgoing OAuth connections. They also need to be able to modify an outgoing OAuth connection's token URL and trigger connection validation.

Q: What is exposed if exploitation succeeds?

The stored client secret for the outgoing OAuth connection can be sent to an attacker-controlled endpoint during validation. The issue affects confidentiality only; the provided vector does not indicate integrity or availability impact.

Q: Are all Mattermost deployments affected by default?

Exploitation depends on an outgoing OAuth connection with a stored client secret and on a user having permission to manage outgoing OAuth connections. The provided information does not establish whether such connections or permissions exist in a default deployment.

Q: What can be done before updating?

Restrict the permission to manage outgoing OAuth connections to trusted administrators. Review and limit who can change token URLs or initiate validation for these connections.

Q: How can administrators assess whether they may be affected?

Check whether the deployment runs Mattermost 11.9.x through 11.9.1, 11.8.x through 11.8.5, 11.7.x through 11.7.10, or 11.10.x through 11.10.1. Also identify outgoing OAuth connections with stored client secrets and users who can manage or validate them.

Published Oct 16, 2026

Updated

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761

Affected Software

1 affected component

Mattermost Mattermost<=11.9.1, <=11.8.5, <=11.7.10, <=11.10.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Mattermost to a version that resolves this vulnerability.
Patch MMSA-2026-00761

Event History

Oct 16, 2026

CVE Published

via MITRE·06:54 AM

Data Sourced

via MITRE·06:54 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated and have permission to manage outgoing OAuth connections. They also need to be able to modify an outgoing OAuth connection's token URL and trigger connection validation.

What is exposed if exploitation succeeds?

The stored client secret for the outgoing OAuth connection can be sent to an attacker-controlled endpoint during validation. The issue affects confidentiality only; the provided vector does not indicate integrity or availability impact.

Are all Mattermost deployments affected by default?

Exploitation depends on an outgoing OAuth connection with a stored client secret and on a user having permission to manage outgoing OAuth connections. The provided information does not establish whether such connections or permissions exist in a default deployment.

What can be done before updating?

Restrict the permission to manage outgoing OAuth connections to trusted administrators. Review and limit who can change token URLs or initiate validation for these connections.

How can administrators assess whether they may be affected?

Check whether the deployment runs Mattermost 11.9.x through 11.9.1, 11.8.x through 11.8.5, 11.7.x through 11.7.10, or 11.10.x through 11.10.1. Also identify outgoing OAuth connections with stored client secrets and users who can manage or validate them.

CVE-2026-19541: Outgoing OAuth connection client secret exposure during connection validation

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is exposed if exploitation succeeds?

Are all Mattermost deployments affected by default?

What can be done before updating?

How can administrators assess whether they may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is exposed if exploitation succeeds?

Are all Mattermost deployments affected by default?

What can be done before updating?

How can administrators assess whether they may be affected?