CVE-2026-2455: SSRF bypass via IPv4-mapped IPv6 literals

Q: What is the severity of CVE-2026-2455?

CVE-2026-2455 has been classified as a critical severity vulnerability due to its potential for allowing SSRF attacks.

Q: How do I fix CVE-2026-2455?

To fix CVE-2026-2455, upgrade Mattermost to versions 11.3.1, 11.2.3, or 10.11.11 or later.

Q: What is the impact of CVE-2026-2455?

CVE-2026-2455 allows attackers to bypass reserved IP validation, enabling SSRF attacks against internal services.

Q: Which versions of Mattermost are affected by CVE-2026-2455?

Mattermost versions 11.3.0, 11.2.2, and 10.11.10 are affected by CVE-2026-2455.

Q: Is there a workaround for CVE-2026-2455?

There is no recommended workaround for CVE-2026-2455; updating to a patched version is the best course of action.

Published Mar 16, 2026

Updated

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation which allows an attacker to perform SSRF attacks against internal services via IPv4-mapped IPv6 literals (e.g., [::ffff:127.0.0.1]).. Mattermost Advisory ID: MMSA-2026-00585

Affected Software

4 affected components

Mattermost Mattermost<=11.3.0, <=11.2.2, <=10.11.10

Mattermost Mattermost Server>=10.11.0<10.11.11

Mattermost Mattermost Server>=11.2.0<11.2.3

Mattermost Mattermost Server>=11.3.0<11.3.1

Remediation

Information

Update Mattermost to versions 11.4.0, 11.3.1, 11.2.3, 10.11.11 or higher.

Event History

Mar 16, 2026

CVE Published

via MITRE·02:53 PM

Data Sourced

via MITRE·02:53 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-2455?

CVE-2026-2455 has been classified as a critical severity vulnerability due to its potential for allowing SSRF attacks.

How do I fix CVE-2026-2455?