CVE-2026-10556

Executive Summary

CVE-2026-10556 is a denial-of-service vulnerability in the Mattermost Microsoft Calendar plugin, affecting Mattermost versions 11.9.x (<= 11.9.0), 11.8.x (<= 11.8.4), 11.7.x (<= 11.7.7), and 10.11.x (<= 10.11.22). The plugin fails to validate null entries within Microsoft Graph webhook notification payloads, allowing an unauthenticated remote attacker to submit a crafted POST request to the public webhook endpoint and crash the plugin process. Successful exploitation denies calendar integration service to all users on the affected instance, degrading collaboration features but not compromising confidentiality or integrity (CVSS 5.3).

Technical Analysis

The vulnerability class is CWE-754, Improper Check for Unusual or Exceptional Conditions. Mattermost's Microsoft Calendar plugin exposes a public webhook endpoint intended to receive Microsoft Graph change-notification callbacks. Microsoft Graph delivers notifications as JSON payloads containing a value array of notification objects, each with subscriptionId, changeType, resource, and resourceData fields.

Per the NVD description, the plugin fails to validate null entries in incoming webhook notification payloads. When a notification array element or a nested field is null rather than an expected object, code that dereferences the null value encounters an exceptional condition that is not handled. The unhandled condition terminates the plugin process. Because the vulnerable endpoint is public (it must be reachable by Microsoft infrastructure and is not gated by Mattermost authentication), an attacker requires no credentials (PR:N) and no user interaction (UI:N).

Key attack-surface characteristics:

• Vector: Network (AV:N), reachable by any host that can route to the Mattermost instance.
• Complexity: Low (AC:L) — a single crafted POST with a null element in the notification structure is sufficient.
• Scope: Unchanged (S:U) — impact is confined to the plugin process.
• Impact: Availability only, rated Low (A:L) — the platform core remains up, but calendar integration is denied instance-wide.

No public advisory text, function names, class names, or code excerpts beyond the NVD description are available. The precise parsing routine that mishandles the null value is not disclosed in the supplied intelligence. The mechanism is best described at the class level: unsafe dereference of a null notification entry inside the webhook ingestion path causes an uncaught fatal exception and process termination.

Exploitation Scenarios

Note: No public proof-of-concept, exploit code, or Nuclei template exists. The attack chain below is inferred strictly from the vulnerability class (CWE-754) and the description of the affected component. No function names, endpoints, or parameters beyond those in the NVD description are asserted.

1. Reconnaissance / target identification. The attacker identifies an internet-exposed Mattermost instance running one of the affected version ranges (11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22). Public exposure can be located via search engines or scanning for Mattermost login pages and plugin webhook paths. The attacker must confirm the Microsoft Calendar plugin is enabled, since the vulnerable webhook endpoint only exists when the plugin is active.

2. Triggering the flaw class. The attacker sends a crafted POST request to the plugin's public webhook endpoint. Unlike a legitimate Microsoft Graph notification, the body includes a null entry where the plugin expects a notification object or a populated field. The plugin's parser accepts the request but performs no null validation before dereferencing the entry.

3. Payload / execution at the class level. This is not code execution. The crafted payload induces an unhandled exceptional condition (null dereference or equivalent fatal error) in the plugin process. The process exits/crashes rather than returning an error to the caller. No authentication or special headers beyond the endpoint's expected content type are required.

4. Post-exploitation impact. With the Microsoft Calendar plugin process down, calendar synchronization and Microsoft Graph integration stop for all users on the instance. The attacker can repeat the request to maintain the denial (a persistent DoS loop), since there is no rate limiting or validation fix in the affected versions. Core chat functionality is unaffected, limiting blast radius to the calendar integration, consistent with the A:L subscore.

Impact Assessment

• Confidentiality (C:N): No data exposure; the flaw does not read or return protected data.
• Integrity (I:N): No modification of data; the payload is rejected at the process level rather than persisted.
• Availability (A:L): The calendar integration service becomes unavailable to every user on the instance until the plugin is restarted. Multi-tenant or hostname-shared deployments can be repeatedly targeted, sustaining the outage.
• Business impact: Loss of calendar/meeting synchronization degrades scheduling and collaboration workflows. Organizations relying on Mattermost + Microsoft 365 calendar sync experience operational friction but not data loss. Because exploitation is unauthenticated and trivial (AC:L, PR:N, UI:N), the volume of potential attackers is high, even though the CVSS base remains 5.3.
• Blast radius: Instance-wide for the calendar plugin; no lateral movement, no escalation, no credential compromise.

Detection Guidance

Detection focuses on anomalous POST traffic to the public webhook endpoint followed by plugin process termination, and on correlation between inbound webhook requests and plugin restart/crash events.

Sigma Rule

title: Mattermost Microsoft Calendar Plugin Webhook Null-Entry DoS Attempt
id: 8f3c2a14-5b6e-4c9a-9d21-7e0f1b2c3d44
status: experimental
description: Detects repeated POST requests to the Mattermost Microsoft Calendar plugin public webhook endpoint, indicative of CVE-2026-10556 null-entry DoS attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-10556
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1190
  - cve.2026.10556
logsource:
  category: webserver
  product: mattermost
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|contains:
      - '/plugins/'
      - 'webhook'
  selection_body:
    cs-body|contains:
      - 'null'
      - 'subscriptionId'
  condition: selection_endpoint and selection_body
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
falsepositives:
  - Legitimate Microsoft Graph notifications containing null optional fields
level: medium

YARA Rule

rule CVE_2026_10556_Mattermost_Calendar_Webhook_NullDos
{
    meta:
        description = "Detects crafted webhook payloads targeting the Mattermost Microsoft Calendar plugin null-entry DoS (CVE-2026-10556)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-10556"
        severity = "medium"

    strings:
        $a = "subscriptionId" ascii nocase
        $b = "changeType" ascii nocase
        $c = "resourceData" ascii nocase
        $n = "null" ascii
        $arr = "[null" ascii
        $arr2 = ":null" ascii

    condition:
        uint16(0) == 0x7B7B or true and
        any of ($a, $b, $c) and
        1 of ($n, $arr, $arr2) and
        filesize < 64KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-10556 Mattermost Microsoft Calendar Plugin Webhook Null-Entry DoS Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"webhook"; nocase; http.request_body; content:"\"value\""; nocase; http.request_body; content:"null"; within:200; http.request_body; content:"subscriptionId"; nocase; reference:cve,2026-10556; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-10556; classtype:attempted-dos; sid:202610556; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and http.request.method == "POST" and
     url.path : "*webhook*" and
     url.path : "*plugins*"]
  [file where event.type == "deletion" or event.action == "end" and
     process.name : "*mattermost*" and process.name : "*calendar*"]

Splunk SPL Query

index=web sourcetype=mattermost:web OR sourcetype=access_combined
| search method=POST uri_path="*webhook*" uri_path="*plugins*"
| eval suspicious=if(match(body, "(?i)null") AND match(body, "(?i)subscriptionId"), 1, 0)
| where suspicious=1
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="mattermost,cve-2026-10556,web,">
  <rule id="202610556" level="10">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="uri" type="pcre2">(?i).*webhook.*plugins.*</field>
    <regex type="pcre2">(?i)null.*subscriptionId|subscriptionId.*null</regex>
    <description>CVE-2026-10556: Possible Mattermost Microsoft Calendar webhook null-entry DoS attempt from $(srcip)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_attempt,ddos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No vendor fix or tracked patch source currently addresses CVE-2026-10556. The Mattermost advisory identifier MMSA-2026-00693 is referenced, but no patched version has been confirmed in the supplied intelligence.

1. Immediate mitigations:

   • Restrict network access to the Microsoft Calendar plugin's public webhook endpoint to known Microsoft Graph outbound IP ranges (and any other legitimately trusted notification sources) using firewall, reverse proxy, or WAF ACLs.
   • If the Microsoft Calendar integration is not required, disable the plugin entirely — this removes the vulnerable endpoint.
   • Deploy a WAF rule to reject POST bodies to the webhook path containing null array entries or malformed notification structures, matching the class-level signature (null element where an object is expected).
   • Enable rate limiting and restrictive content-type enforcement on the webhook endpoint to blunt repeated DoS attempts.
   • Monitor plugin process health and configure automatic restart, while treating restart events as a detection signal of ongoing abuse.

2. Patch/upgrade steps:

   • Track Mattermost security advisories for MMSA-2026-00693 and the corresponding plugin/server release that adds null-entry validation.
   • Once a fixed version is published, upgrade Mattermost server and the Microsoft Calendar plugin to the patched release (applies across the 10.11.x, 11.7.x, 11.8.x, and 11.9.x lines).
   • Until then, do not rely on a patch — apply compensating controls above.

3. Long-term hardening:

   • Enforce strict schema validation (reject absent/null required fields) on all inbound webhook payloads before dereferencing.
   • Implement signature verification for Microsoft Graph notifications so spoofed requests are rejected at the edge.
   • Segment plugin processes so a crash cannot cascade to other integrations; correlate plugin crashes with inbound request logs in the SOC.
   • Maintain an attack-surface inventory of internet-exposed plugin endpoints and review exposure regularly.

References

• NVD — CVE-2026-10556: https://nvd.nist.gov/vuln/detail/CVE-2026-10556
• Mattermost Security Advisories (MMSA-2026-00693): https://mattermost.com/security-updates/
• MITRE CWE-754 — Improper Check for Unusual or Exceptional Conditions: https://cwe.mitre.org/data/definitions/754.html
• Microsoft Graph change notifications documentation (webhook payload structure): https://learn.microsoft.com/graph/webhooks
• CISA KEV Catalog: Not listed — no evidence of exploitation in the wild as of report generation; EPSS 0.00248 (16.3rd percentile). No known threat actor campaigns are associated with this CVE at this time.