CVE-2026-86348

Executive Summary

CVE-2026-86348 is a denial-of-service vulnerability in Mattermost, an open-source enterprise messaging and collaboration platform. Mattermost versions up to and including 11.9, 11.0.9, 11.4.8, 11.7.7, and 10.22.11.0 fail to recover from handler panics, allowing an authenticated user to crash the plugin by sending a post-action request containing an unexpected field type. The impact is limited to availability (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L); confidentiality and integrity are unaffected, but a low-privileged authenticated attacker can disrupt plugin functionality for targeted deployments.

Technical Analysis

The vulnerability is classified as CWE-704 (Incorrect Type Conversion or Cast). Per the NVD description, the root cause is that affected Mattermost versions "fail to recover from handler panics." In Go-based server software such as Mattermost, a panic is a runtime failure that aborts the current goroutine unless it is intercepted by a recover() call. The description states that the panic occurs when an authenticated user issues a "post-action request with an unexpected field type." An unexpected field type in a post-action request means the handler receives a value whose concrete type does not match what the code expects (for example, a structured/object value where a string or primitive was anticipated). Under CWE-704, the handler does not correctly convert or validate the incoming type, and the subsequent type assertion or conversion triggers a panic. Because the panic is not recovered, the handler — and by extension the plugin serving the request — crashes.

The attack surface is the post-action request interface. This is a network-reachable, authenticated endpoint (AV:N, PR:L). No user interaction (UI:N) is required beyond the attacker submitting the crafted request. The scope is unchanged (S:U) and the impact is availability-only at the Low level (A:L), reflecting a crash of the plugin rather than a full-platform outage. Two distinct weaknesses combine: (1) missing type validation on the unexpected field, and (2) absence of panic recovery in the request handler. Either a correct type check or a recover() guard would prevent the crash.

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE. The analysis is therefore based on the vulnerability class (incorrect type conversion leading to an unrecovered panic) and the exposed interface (authenticated post-action requests).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description, and uses only the interface named in the description (a post-action request).

1. Reconnaissance/target identification. The attacker identifies internet- or intranet-exposed Mattermost instances, confirming the version is within the affected range (≤11.9, 11.0.9, 11.4.8, 11.7.7, 10.22.11.0). Because the vulnerability requires authentication (PR:L), the attacker either holds a valid low-privileged account, self-registers where open registration is enabled, or obtains credentials through separate means. No public exploit code exists, so the attacker must craft the request manually based on the known weakness.

2. Triggering the flaw class. The attacker sends an authenticated post-action request in which one field is supplied with an unexpected type — a value whose type does not match what the handler expects. This mirrors the description exactly: a "post-action request with an unexpected field type."

3. Payload/execution method. The unexpected type causes a type conversion/assertion failure that manifests as a panic inside the request handler. Because the handler does not recover from the panic, the plugin crashes. The precise field name and expected type are not disclosed in the available intelligence; the mechanism is a type-mismatch-induced panic, not memory corruption or code execution.

4. Post-exploitation impact. The result is a denial of service against the plugin: its functionality becomes unavailable until the plugin recovers or is restarted. There is no evidence of data exfiltration, integrity tampering, or privilege escalation. Repeated requests against multiple plugins or instances could sustain the outage and degrade collaboration services for affected teams.

Impact Assessment

The impact is availability-only and rated Low (A:L). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L indicates: network-exploitable, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, no integrity impact, and low availability impact. The blast radius is bounded by the fact that the crash affects the plugin rather than the entire Mattermost server, limiting the operational disruption to features provided by the impacted plugin. Business impact includes temporary loss of plugin-dependent workflows (integrations, bots, or automation implemented as plugins), potential user frustration, and SOC/IT time spent restarting or recovering the affected plugin. The EPSS score of 0.00217 (12.2nd percentile) and the absence of CISA KEV listing indicate that observed exploitation is currently unlikely, and no known threat-actor campaign targets this CVE. Because the flaw is triggered only after authentication, the practical risk is highest in environments allowing broad self-registration or where many low-trust accounts exist.

Detection Guidance

Sigma Rule

title: Mattermost Post-Action Request Type Mismatch Panic Attempt
id: 6f3a1c2e-9d4b-4a7e-8c1f-2b6e9d0a4f11
status: experimental
description: Detects authenticated post-action requests with malformed/unexpected field types that may trigger an unrecovered handler panic causing plugin crash (CVE-2026-86348)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86348
author: valtersit.com
date: 2026-01-01
logsource:
  product: mattermost
  service: audit
detection:
  selection_request:
    event_type: 'post_action'
  selection_type_error:
    error|contains:
      - 'panic'
      - 'type assertion'
      - 'interface conversion'
      - 'unexpected type'
  condition: selection_request and selection_type_error
falsepositives:
  - Legitimate malformed client requests during development
level: medium
tags:
  - attack.t1499
  - cwe.704

YARA Rule

rule CVE_2026_86348_Mattermost_PostAction_Panic
{
    meta:
        description = "Detects Mattermost request handling code lacking panic recovery for post-action requests (CVE-2026-86348)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86348"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $post_action = "post_action" ascii nocase
        $recover     = "recover()" ascii
        $typeassert  = "interface conversion" ascii
        $panic       = "panic(" ascii

    condition:
        uint32(0) == 0x464c457f and
        $post_action and
        $panic and
        not $recover
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-86348 Mattermost Post-Action Request Unexpected Field Type Panic Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"action"; nocase; http.request_body; content:"\"type\""; nocase; pcre:"/\"[A-Za-z_]+\"\s*:\s*[\[{]/"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,2026-86348; sid:900086348; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=1m
  [http.request.method == "POST" and url.path contains "action"]
  [any where event.category == "process" and process.name == "mattermost" and message contains "panic"]

Splunk SPL Query

index=mattermost sourcetype=mattermost:audit
| search event_type="post_action" OR uri_path="*action*"
| rex field=request_body "(?<fieldtype>\"[A-Za-z_]+\"\s*:\s*[\[{])"
| where isnotnull(fieldtype)
| stats count values(fieldtype) as suspect_fields by src_ip, user, plugin_id
| where count >= 5

Wazuh OSSEC Rule

<group name="mattermost,cve-2026-86348,">
  <rule id="100348" level="8">
    <decoded_as>json</decoded_as>
    <field name="event_type">post_action</field>
    <match>panic|interface conversion|unexpected field type|type assertion</match>
    <description>CVE-2026-86348: Mattermost post-action request triggered an unrecovered handler panic (plugin crash).</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>availability_impact,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Apply the fixed build referenced in Mattermost advisory MMSA-2026-00701 as soon as it is published.

1. Immediate mitigations. Restrict ability to reach the post-action interface to trusted authenticated users; audit and reduce low-trust or self-registered accounts that could submit crafted requests. Ensure the Mattermost plugin host (if externally configured) restarts crashed plugins automatically to shorten the DoS window. Monitor for repeated post-action requests containing unexpected field types and alert on panic/type-assertion errors in server logs.
2. Patch/upgrade steps. Track MMSA-2026-00701 and NVD for the fixed release, then upgrade affected instances (≤11.9, 11.0.9, 11.4.8, 11.7.7, 10.22.11.0) to the patched version. Validate plugin functionality after upgrade and confirm the affected plugin no longer panics on malformed field types.
3. Long-term hardening. Require type validation on all request payload fields before conversion/assertion; wrap plugin request handlers with panic-recovery middleware so a single malformed request cannot crash a plugin; adopt fuzzing and negative-input testing for post-action handlers; apply least privilege to accounts that can invoke plugin actions; and feed Mattermost audit logs into the SIEM with the detection rules above.

References

• NVD — CVE-2026-86348: https://nvd.nist.gov/vuln/detail/CVE-2026-86348
• Mattermost Security Advisories (MMSA-2026-00701): https://mattermost.com/security-updates/
• CWE-704 — Incorrect Type Conversion or Cast: https://cwe.mitre.org/data/definitions/704.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• FIRST EPSS — CVE-2026-86348 score lookup: https://api.first.org/data/v1/epss?cve=CVE-2026-86348

Threat actor campaign / exploit-in-the-wild evidence: None identified. CISA KEV status: NOT listed. Public PoC: None. Nuclei template: NO. Exploit code: NO.