Our news and updates

In Traefik versions prior to 3.6.8 a high severity vulnerability CVE-2026-25949 was detected. This vulnerability allows an unauthenticated attacker to bypass the entrypoint respondingTimeouts.readTimeout setting by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and stalling the connection, causing connections to remain open indefinitely and potentially leading to a denial-of-service condition. To address this issue, users should upgrade Traefik to version 3.6.8 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25949.

In Mattermost versions 11.1.x up to and including 11.1.2, 10.11.x up to and including 10.11.9, 11.2.x up to and including 11.2.1 and Mattermost Plugin Zoom versions up to and including 1.11.0 a medium severity vulnerability CVE-2026-0997 was detected. This vulnerability allows authenticated users to modify Zoom meeting restrictions for arbitrary channels via crafted API requests due to insufficient validation of the authenticated user in the /plugins/zoom/api/v1/channel-preference endpoint. To address this issue, users should upgrade Mattermost and the Mattermost Zoom Plugin to versions 11.3.0, 11.1.3, 10.11.10 or 11.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-0997.

In Mattermost versions 10.11.x up to and including 10.11.9 a low severity vulnerability CVE-2025-14573 was detected. This vulnerability allows team administrators without proper invite permissions to bypass restrictions and add users to their team via crafted API requests due to improper enforcement of invite permission checks when updating team settings through the allow_open_invite field. To address this issue, users should upgrade to versions 11.3.0 or 10.11.10. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-14573.

In Mattermost versions 11.1.x up to and including 11.1.2, 10.11.x up to and including 10.11.9, and 11.2.x up to and including 11.2.1 a medium severity vulnerability CVE-2025-14350 was detected. This vulnerability allows authenticated users to determine the existence of teams and their URL names by posting channel shortlinks and observing the channel_mentions property in the API response due to improper validation of team membership when processing channel mentions. To address this issue, users should upgrade Mattermost to versions 11.3.0, 11.1.3, 10.11.10 or 11.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-14350.

In Mattermost versions 11.1.x up to and including 11.1.2, 10.11.x up to and including 10.11.9, and 11.2.x up to and including 11.2.1 a medium severity vulnerability CVE-2025-13821 was detected. This vulnerability allows authenticated users to exfiltrate sensitive information, including password hashes and MFA secrets, via profile nickname updates or email verification events due to improper sanitization of sensitive data in WebSocket messages. To address this issue, users should upgrade Mattermost to versions 11.3.0, 11.1.3, 10.11.10 or 11.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13821.

In PostgreSQL versions 18.0 and 18.1 a high severity vulnerability CVE-2026-2007 was detected. This vulnerability allows a database user to trigger a heap buffer overflow via a crafted input string in the pg_trgm extension, which may lead to privilege escalation or other unintended impacts due to improper memory handling. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-2007.

In Mattermost versions 11.1.x up to and including 11.1.2, 10.11.x up to and including 10.11.9 and 11.2.x up to and including 11.2.1 a medium severity vulnerability CVE-2026-0999 was detected. This vulnerability allows authenticated users to bypass SSO-only login requirements via userID-based authentication due to improper validation of login method restrictions. To address this issue, users should upgrade Mattermost to versions 11.3.0, 11.1.3, 10.11.10 or 11.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-0999.

In Mattermost versions 11.1.x up to and including 11.1.2, 10.11.x up to and including 10.11.9, 11.2.x up to and including 11.2.1 and Mattermost Plugin Zoom versions up to and including 1.11.0, a high severity vulnerability CVE-2026-0998 was detected. This vulnerability allows attackers to start Zoom meetings as any user and overwrite arbitrary posts via direct API calls with manipulated user IDs and post data due to insufficient validation of user identity and post ownership in the /api/v1/askPMI endpoint. To address this issue, users should upgrade Mattermost and the Mattermost Zoom Plugin to versions 11.3.0, 11.1.3, 10.11.10 or 11.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-0998.

In Mattermost Jira Plugin versions 11.1.x up to and including 11.1.2, 10.11.x up to and including 10.11.9 and 11.2.x up to and including 11.2.1 a medium severity vulnerability CVE-2026-22892 was detected. This vulnerability allows authenticated attackers with access to the Jira plugin to read post content and attachments from channels they do not have access to by providing the post ID to the /create-issue API endpoint due to insufficient authorization validation. To address this issue, users should upgrade Mattermost Jira Plugin to versions 11.3.0, 11.1.3, 10.11.10 or 11.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22892.