CVE-2026-19601: Disclosure of AD/LDAP bind password via Test Connection
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature. Mattermost Advisory ID: MMSA-2026-00764
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.9.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.6 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.11 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.10.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires System Console administrator privileges. The administrator must be able to change AD/LDAP connection settings and invoke the Test Connection or diagnostics feature.
What must an attacker do to obtain the bind password?
The attacker needs to change connection settings such as the LDAP server address to point to an attacker-controlled server, then use Test Connection or diagnostics. Because the stored bind password is not invalidated after those settings change, it can be disclosed in plaintext to that server.
Are deployments without AD/LDAP integration affected?
The described exposure concerns the stored AD/LDAP bind password and the AD/LDAP Test Connection or diagnostics functionality. The provided information does not indicate an impact where no AD/LDAP bind password is configured.
Which Mattermost releases are identified as affected?
Affected releases are Mattermost 11.7.x through 11.7.10, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.1.