CVE-2026-93848: Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator
Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request which allows a System Administrator to determine whether internal addresses and ports are reachable from the server via an unauthenticated login request that triggers the discovery fetch.. Mattermost Advisory ID: MMSA-2026-00774
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.11
Event History
Frequently Asked Questions
Which deployments are affected?
Mattermost 11.7.x deployments through 11.7.10 are affected. The issue concerns the OpenID discovery endpoint's outbound request handling.
What access does an attacker need to exploit this?
An attacker needs System Administrator privileges to configure or otherwise cause the vulnerable OpenID discovery request. The discovery fetch itself can then be triggered through an unauthenticated login request.
What can exploitation reveal?
It allows the System Administrator to determine whether internal addresses and ports are reachable from the Mattermost server. The listed impact is limited to confidentiality; integrity and availability impacts are not indicated.