CVE-2026-19600: Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.11.0
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
An attacker needs access to debug-level Mattermost server logs containing failed authentication attempts. The exposed tokens can include valid session tokens or OAuth access tokens, allowing impersonation of authenticated users.
Is debug logging a condition for exposure?
Yes. The token disclosure occurs through debug-level Mattermost server log entries, so deployments not retaining or exposing debug-level server logs are not described as affected through this vector.
Which releases are affected?
Affected releases are Mattermost 11.9.x through 11.9.1, 11.8.x through 11.8.5, 11.7.x through 11.7.10, and 11.10.x through 11.10.1.
How can administrators determine whether tokens may already have been exposed?
Review access to debug-level server logs and inspect whether those logs contain failed authentication-attempt entries with plaintext authentication tokens. Any party that could read such entries may have obtained usable session or OAuth access tokens.