CVE-2026-6333: SSRF via Host Header Spoofing in Custom Slash Commands
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an attacker-controlled server via a spoofed Host header.. Mattermost Advisory ID: MMSA-2026-00582
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.6.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.5.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.14 - Compensating control
Until upgraded, restrict authenticated slash-command access to trusted users and monitor for unexpected redirect behavior from slash command responses (SSRF via Host header spoofing).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6333?
CVE-2026-6333 has a high severity rating due to the potential for unauthorized redirection of slash command responses.
How do I fix CVE-2026-6333?
To fix CVE-2026-6333, upgrade Mattermost to versions 11.5.2 or later, and 10.11.14 or later.
Which Mattermost versions are affected by CVE-2026-6333?
CVE-2026-6333 affects Mattermost versions 11.5.0 to 11.5.1 and 10.11.0 to 10.11.13.
Who can exploit CVE-2026-6333?
CVE-2026-6333 can be exploited by authenticated attackers through host header spoofing.
What is the impact of CVE-2026-6333?
The impact of CVE-2026-6333 includes the ability of an attacker to redirect responses from custom slash commands to malicious endpoints.