tocsin

Go/github.com/mattermost/mattermost/server/v8 CVE-2026-6333: low 3.5, EPSS 0.14%

Mattermost doesn't validate the Host header when constructing response URLs for custom slash command

Action: Upgrade github.com/mattermost/mattermost/server/v8 to 8.0.0-20260325160634-e738016c5920 or later.

go get github.com/mattermost/mattermost/server/v8@v11.5.2
go get github.com/mattermost/mattermost/server/v8@v10.11.14
go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260325160634-e738016c5920

Affected

introducedfixedlast affected
11.5.011.5.2-
10.11.010.11.14-
08.0.0-20260325160634-e738016c5920-

Fixed versions

11.5.210.11.148.0.0-20260325160634-e738016c5920

Sources

CVE-2026-6333 · published · modified · JSON