CVE-2026-75588

Executive Summary

CVE-2026-75588 is a URL scheme validation flaw (CWE-1287) in the Mattermost Desktop App affecting versions up to and including 6.2.2.0. When the application evaluates whether a target URL is internal to the connected server, it fails to validate the URL scheme, allowing a network-positioned attacker to downgrade a link to an insecure scheme and load a plugin popout window over an unencrypted connection. The vulnerability carries a CVSS v3.1 base score of 2.6 (Low), reflecting high attack complexity, required user interaction, and limited integrity impact — but it represents a meaningful weakening of the desktop client's trust boundary that becomes more dangerous when chained with additional weaknesses.

Technical Analysis

The Mattermost Desktop App (Electron-based) implements a URL classification routine that determines whether a given target URL is "internal" to the connected Mattermost server — that is, whether it should be handled by the client's trusted, authenticated web view rather than handed off to the operating system's default browser. Per the NVD description, versions <= 6.2 6.2.2.0 fail to validate the URL scheme during this check.

A correct implementation of an "is this URL internal to the server?" check must validate the full origin: scheme, host, and port. The scheme component is security-critical because the server's trusted origin is served over HTTPS. If the scheme validation is omitted, an attacker can present a URL that shares the correct host but uses a downgraded scheme (for example, HTTP rather than HTTPS), and the client will still classify it as internal to the connected server.

This is a variant of CWE-1287 — improper validation of a specified type of input. The "specified type" here is the URL scheme token within a crafted link. Because the check is scheme-blind, the attacker-supplied link bypasses the expected "internal origin" trust assumption.

The second half of the flaw is what the description calls a plugin popout window. Mattermost supports plugins (apps), and plugin UI may be rendered in a separate popout window. The popout window is the attack surface: because the URL was misclassified as internal, the desktop client loads this popout over the downgraded, insecure connection rather than refusing it or forcing the trusted HTTPS origin. The attacker therefore influences the content origin of a privileged application window, and that window is fetched over a channel an attacker with network position can read and manipulate.

Key constraints on exploitability, drawn directly from the CVSS vector:

• AV:N (Network) — the attacker does not require local access; network position is sufficient.
• AC:H (High) — the attack depends on conditions outside the attacker's full control: a network-positioned adversary, the victim's server topology, and a link the victim must follow.
• PR:L (Low) — the attacker requires some low-level privileges, consistent with a malicious or compromised actor who can place a link within the user's reach (for example as a peer on the affected server).
• UI:R (User Interaction Required) — the victim must click the crafted link.
• S:U (Unchanged) — the vulnerable component's security scope is not modeled as extending beyond itself.
• C:N / I:L / A:N — no confidentiality or availability impact asserted; low integrity impact, consistent with an attacker being able to influence the content loaded into a client window via a downgraded connection.

No function names, class names, or URL endpoints are provided in the NVD description or CNA title, and none are asserted here. The description is sparse; the analysis above is confined to the vulnerability class (scheme validation failure in URL classification) and the described mechanism (plugin popout loaded over a downgraded scheme).

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-75588. The chain below is inferred strictly from the vulnerability class and the NVD description; it contains no invented function names, endpoints, or code patterns.

1. Reconnaissance / target identification. The attacker identifies organizations using the Mattermost Desktop App on affected versions (<= 6.2.2.0) and, critically, obtains network position between the victim client and the Mattermost server. This can be achieved via a hostile or compromised Wi-Fi access point, an on-path position on a corporate network segment, or any legitimate network position from which traffic to the server can be observed and modified. Because the vector requires network position, this is a prerequisite rather than a step the attacker can skip.

2. Triggering the specific flaw class. The attacker requires the victim to follow a link. The link points to the connected server's host but specifies a downgraded URL scheme. Because the desktop client does not validate the scheme when deciding whether the URL is internal to the server, it classifies the link as internal and proceeds to handle it as trusted — the exact bypass this CVE describes. The delivery of the link is where the low privilege requirement (PR:L) is satisfied: a malicious actor with a presence on the server (for example a peer who can post or message the victim) can supply the link.

3. Payload / execution method at the vulnerability-class level. The misclassified URL causes the client to load a plugin popout window over the insecure, downgraded connection. The attacker's network position now becomes decisive: traffic on the downgraded scheme can be intercepted and altered, so the attacker can substitute the content delivered into the popout window. The vulnerability class (improper validation of the specified input type, i.e., scheme-blind URL classification) is what lets the protected, more trusted window be pointed at attacker-influenceable content in the first place.

4. Post-exploitation impact. The asserted impact is limited to integrity (I:L). The attacker gains the ability to determine what is rendered in a plugin popout window of the desktop client. No confidentiality or availability impact is claimed by the CVSS vector (C:N, A:N), and scope is unchanged (S:U). The realistic risk is not immediate code execution but the violation of the origin/trust boundary: a window the user reasonably believes is internal content can be made to display attacker-controlled content. This is the kind of foothold that becomes more consequential when chained with a rendering or plugin-level flaw, which is why the low base score should not be read as "no consequence."

Impact Assessment

Business impact. The affected asset is the Mattermost Desktop App, an endpoint client used for enterprise chat and collaboration. The impact is a weakened trust boundary within that client rather than a server-side breach: an on-path attacker can cause a plugin popout window to load content over an insecure connection. The practical business consequence is increased exposure to credential-phishing and content-spoofing within a window the user perceives as internal, plus loss of the integrity guarantee that the desktop client only renders content from the validated server origin. Because confidentiality and availability are not impacted per the CVSS vector, the direct impact is bounded.

Affected systems. Mattermost Desktop App versions up to and including 6.2 6.2.2.0. No OSV package data or affected-version enumeration was supplied beyond the NVD statement, and no patch is available.

Blast radius. Scoped to individual affected desktop clients on networks where an attacker can obtain a man-in-the-middle position. The scope metric is S:U, so each exploitation is contained to the client instance; there is no asserted cross-boundary escape. The exposure scales with the number of affected clients reachable by an on-path adversary.

CVSS subscores. Base 2.6 = AV:N / AC:H / PR:L / UI:R / S:U / C:N / I:L / A:N. The low global score is driven by High attack complexity (network position plus forced downgrade conditions), mandatory user interaction, and the absence of confidentiality/availability impact. The integrity component (I:L) and the network attack vector (AV:N) are the two factors that keep this from being a purely cosmetic issue. EPSS has not yet been scored by FIRST.org; no exploitation-in-the-wild evidence and no CISA KEV listing exist.

Detection Guidance

Sigma Rule

title: Mattermost Desktop Scheme-Downgrade URL Handling (CVE-2026-75588)
id: 4d9f1c2a-7558-4e88-9a11-202675588000
status: experimental
description: Detects Mattermost Desktop client processes initiating outbound connections to a connected Mattermost server host over a downgraded (non-HTTPS) scheme, consistent with CVE-2026-75588 URL scheme validation bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75588
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: network_connection
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\Mattermost.exe'
      - '\mattermost-desktop'
      - '\Mattermost'
  selection_port:
    DestinationPort:
      - 80
      - 8080
  condition: selection_proc and selection_port
falsepositives:
  - Legitimate administrative access to a Mattermost deployment configured behind a non-standard reverse proxy port
  - Internal testing environments
level: medium
tags:
  - attack.t1189
  - cve.2026.75588

YARA Rule

rule CVE_2026_75588_Mattermost_Scheme_Downgrade
{
    meta:
        description = "Detects Mattermost Desktop artifacts referencing a plugin popout URL with a downgraded (http) scheme, associated with CVE-2026-75588"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75588"
        date = "2026-01-01"
        cve = "CVE-2026-75588"

    strings:
        $popout = "popout" ascii nocase
        $plugin = "plugin" ascii nocase
        $mm     = "mattermost" ascii nocase
        $http   = "http://" ascii nocase
        $https  = "https://" ascii nocase

    condition:
        uint32(0) != 0x504B0304 and
        filesize < 10MB and
        $mm and $popout and $plugin and $http and not $https
}

Note: this YARA rule is heuristic — it flags artifacts that reference a plugin popout URL over a plaintext scheme. It is not a precise signature and will require tuning against known-clean Mattermost client files during deployment.

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET [80,8080] (msg:"CVE-2026-75588 Mattermost Desktop plugin popout over downgraded URL scheme"; flow:to_server,established; content:"mattermost"; http_uri; nocase; content:"popout"; http_uri; nocase; content:"plugin"; http_uri; nocase; classtype:policy-violation; reference:cve,2026-75588; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-75588; sid:2026755880; rev:1;)

Note: this rule matches plaintext HTTP requests to a Mattermost host carrying plugin/popout URI identifiers. Because the vulnerability concerns a scheme downgrade, HTTP (port 80/8080) rather than HTTPS is the relevant transport.

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [ process where process.name in ("Mattermost.exe", "mattermost-desktop") and event.action == "start" ]
  [ network where process.name in ("Mattermost.exe", "mattermost-desktop")
      and destination.port in (80, 8080)
      and network.direction == "egress" ]

Splunk SPL Query

index=network OR index=proxy sourcetype=pan:traffic OR sourcetype=suricata
| search dest_port IN (80, 8080)
| search (uri="*plugin*" AND uri="*popout*") OR http_user_agent="*Mattermost*"
| rex field=uri "(?i)(?<scheme>https?)://(?<host>[^/]+)"
| where lower(scheme)="http"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(host) as target_hosts values(src_ip) as clients
        by dest_ip
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Note: this query targets the observable consequence of the scheme downgrade — a Mattermost client reaching a server host over plaintext HTTP with plugin/popout URI components. Field names differ between proxy and IDS sourcetypes; adapt uri/dest_port to your schema.

Wazuh OSSEC Rule

<group name="mattermost,cve-2026-75588,">
  <rule id="2026755" level="8">
    <if_sid>0</if_sid>
    <field name="process.name">Mattermost\.exe|mattermost-desktop</field>
    <field name="destination.port">^80$|^8080$</field>
    <description>CVE-2026-75588: Mattermost Desktop initiated a connection over a downgraded (non-HTTPS) scheme, possible URL scheme validation bypass.</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>network_anomaly,cve_2026_75588,</group>
  </rule>
</group>

Note: requires endpoint telemetry (Sysmon Event ID 3 network connections, or an equivalent Wazuh decoder) that records both process name and destination port.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, vendor fix, workaround, or affected-version enumeration is available from any tracked source. The only vendor-side reference is the Mattermost advisory ID MMSA-2026-00717. Until a fix ships, treat affected clients as unpatched and apply compensating controls.

1. Immediate mitigations

• Track Mattermost advisory MMSA-2026-00717 for a fixed desktop App release and upgrade as soon as it is published; the <= 6.2.2.0 range is affected.
• Enforce HTTPS-only access to the Mattermost server and, where feasible, refuse plaintext HTTP at the reverse proxy so a downgraded scheme cannot reach a reachable origin.
• Restrict the population of network positions from which an attacker could perform the required on-path manipulation (segmentation, avoiding untrusted Wi-Fi for client access).
• Reduce exposure to the required user interaction: warn users against following unsolicited links that promise Mattermost plugin content, and pair this with phishing-awareness training.
• Consider client-side egress filtering that blocks the Mattermost desktop process from initiating plaintext connections to the server host.

2. Patch / upgrade steps

• Monitor the Mattermost security advisories page and MMSA-2026-00717 for the fixed Desktop App version. No fixed version can be named here — none is provided by any source in this dataset.
• Plan and test the desktop App upgrade through normal change management; Electron client updates are typically distributed via the vendor's auto-update channel and per-platform installers.
• After upgrade, re-verify that the client's URL classification enforces full-origin matching (scheme, host, and port) for internal-URL determination.

3. Long-term hardening

• Require desktop clients to validate the complete origin — including the URL scheme — before treating a URL as internal to the connected server. Scheme-blind origin checks should be treated as a class-level defect.
• Constrain plugin popout windows so they can only render content from the validated, authenticated server origin over a trusted scheme, and never over a downgraded channel.
• Deploy HSTS and HTTPS-only policies so scheme downgrades fail closed at the server edge.
• Instrument the detection logic above (Sigma/YARA/Suricata/Elastic/Splunk/Wazuh) into continuous monitoring and tune the YARA and Splunk heuristics against known-good client baselines.

References

• NVD — CVE-2026-75588: https://nvd.nist.gov/vuln/detail/CVE-2026-75588
• Mattermost Security Advisories (vendor): https://mattermost.com/security-updates/ — Advisory ID MMSA-2026-00717
• CWE-1287 — Improper Validation of Specified Type of Input: https://cwe.mitre.org/data/definitions/1287.html
• FIRST EPSS — CVE-2026-75588: https://api.first.org/data/v1/epss?cve=CVE-2026-75588 (not yet scored; no EPSS value assigned)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-75588 is not listed

Threat actor / exploit-in-the-wild evidence: None. No PoC, exploit code, or Nuclei template is available; no CISA KEV listing; no exploitation-in-the-wild reporting exists. The chain in this report is inferred from the vulnerability class and the NVD description only.