CVE-2026-96259

Executive Summary

CVE-2026-96259 is a Server-Side Request Forgery (SSRF) vulnerability in Mattermost server versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1. The flaw allows an authenticated System Administrator to bypass the internal-connection filter on OAuth endpoint requests, causing the server to issue requests to internal network addresses and read the responses through the configured OAuth token and userinfo endpoints. Successful exploitation enables internal network reconnaissance and potential access to sensitive internal services, with a CVSS score of 5.5 (Medium).

Technical Analysis

CVE-2026-96259 is classified as CWE-918: Server-Side Request Forgery (SSRF). The vulnerability resides in Mattermost's OAuth integration logic. According to the NVD description, the affected versions "fail to apply the internal-connection filter to OAuth endpoint requests." Mattermost includes an internal-connection filter designed to prevent the server from making requests to internal or private network addresses (e.g., RFC 1918 ranges, loopback addresses, link-local addresses, and cloud metadata endpoints). This filter is intended to block SSRF attacks where an attacker supplies a URL that the server then fetches.

In the vulnerable versions, this filter is not applied when the server processes OAuth endpoint requests. Specifically, when a System Administrator configures OAuth token and userinfo endpoints, the server does not validate whether the configured URLs point to internal network addresses. As a result, the server will issue requests to whatever URL is configured, including internal addresses such as http://127.0.0.1:8080, http://169.254.169.254/, or http://10.0.0.1/. Because the OAuth flow returns the response from these endpoints to the user who configured them — via the OAuth token and userinfo endpoint responses — the attacker can read the responses, effectively using the Mattermost server as a proxy to access internal resources.

The attack requires the attacker to hold the System Administrator role. This is a high privilege level (PR:H in the CVSS vector), which limits the attack surface to administrators or accounts that have been compromised and escalated to that role. The vulnerability is network-exploitable (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). The scope is changed (S:C) because the vulnerable component (Mattermost server) impacts resources beyond its security scope (internal network services). Confidentiality and Integrity impacts are Low (C:L/I:L), and Availability impact is None (A:N).

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N, yielding a base score of 5.5. This aligns with the provided score and reflects a medium-severity issue that is constrained by the privileged access requirement but still enables internal network access and data exfiltration through the OAuth response channels.

No public PoC, exploit code, or Nuclei template is available as of this report. The Patch Confidence is 0/4, indicating no patch evidence from any tracked source. The vendor advisory ID is MMSA-2026-00776.

Exploitation Scenarios

1. Reconnaissance/target identification: The attacker identifies a Mattermost instance running a vulnerable version (11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1). The attacker must possess or obtain System Administrator privileges on that instance. This could be achieved through credential theft, privilege escalation, or social engineering against an admin.

2. Triggering the flaw: The attacker navigates to the OAuth configuration settings in the Mattermost System Console. They configure the OAuth token endpoint and/or userinfo endpoint to point to an internal network address, such as http://169.254.169.254/latest/meta-data/ (a cloud metadata endpoint) or http://127.0.0.1:8500/v1/agent/self (a local Consul API). Because the internal-connection filter is not applied to OAuth endpoint requests, the server accepts these internal URLs without validation.

3. Payload/execution method: The attacker initiates an OAuth flow (e.g., by attempting to log in with the OAuth provider). The Mattermost server then sends an HTTP request to the configured internal endpoint. The response from that internal endpoint is returned to the attacker via the OAuth token exchange or userinfo response. The attacker can read the raw response body, which may contain sensitive data from internal services.

4. Post-exploitation impact: The attacker can use the Mattermost server as an SSRF proxy to scan internal networks, access internal APIs, retrieve cloud instance metadata (including temporary credentials), or interact with internal services that lack authentication. This may lead to further compromise of the internal environment, data exfiltration, or lateral movement. The integrity impact is low because the attacker might also be able to send crafted requests that modify internal state (e.g., if the internal endpoint supports state-changing GET requests), though the primary impact is information disclosure.

No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-918) and the NVD description.

Impact Assessment

The vulnerability allows a System Administrator — a highly privileged role — to bypass network segmentation controls and access internal resources. While the privilege requirement reduces the likelihood of exploitation by unauthenticated attackers, it significantly increases the impact when an admin account is compromised or when a malicious insider acts. The SSRF can reach cloud metadata services, internal APIs, databases with HTTP interfaces, and other services bound to localhost or internal IP ranges. Successful exploitation can lead to credential theft (e.g., IAM roles from cloud metadata), internal network mapping, and unauthorized data access. The CVSS score of 5.5 reflects a medium severity: the Scope is Changed (S:C), meaning the vulnerable component affects resources beyond its security scope, but Confidentiality and Integrity impacts are Low (C:L/I:L), and Availability is None (A:N). The blast radius includes any internal service reachable from the Mattermost server's network position. The EPSS score is not yet available, and CISA KEV does not list this CVE, indicating no known active exploitation in the wild at this time.

Detection Guidance

Sigma Rule

title: Mattermost OAuth SSRF Attempt via Internal Endpoint Configuration
id: 8f2c1a4e-9b3d-4f7a-8c2e-1d5f6a7b8c9d
status: experimental
description: Detects configuration of OAuth token or userinfo endpoints pointing to internal/private IP addresses in Mattermost, indicating CVE-2026-96259 exploitation.
author: Threat Intelligence
date: 2026-06-15
logsource:
  product: mattermost
  service: audit
detection:
  selection:
    event: "config_update"
    config_section: "oauth"
select:
    - token_endpoint|contains:
        - "127.0.0.1"
        - "169.254.169.254"
        - "10."
        - "192.168."
        - "172.16."
        - "172.17."
        - "172.18."
        - "172.19."
        - "172.2"
        - "172.30."
        - "172.31."
    - userinfo_endpoint|contains:
        - "127.0.0.1"
        - "169.254.169.254"
        - "10."
        - "192.168."
        - "172.16."
        - "172.17."
        - "172.18."
        - "172.19."
        - "172.2"
        - "172.30."
        - "172.31."
  condition: selection and select
fields:
  - user_id
  - ip_address
  - config_section
  - token_endpoint
  - userinfo_endpoint
falsepositives:
  - Legitimate OAuth providers hosted on private networks (rare)
level: high

YARA Rule

rule CVE_2026_96259_Mattermost_SSRF_OAuth
{
    meta:
        description = "Detects Mattermost OAuth SSRF exploitation attempts in logs or configuration files"
        author = "Threat Intelligence"
        date = "2026-06-15"
        reference = "CVE-2026-96259"
        severity = "medium"

    strings:
        $s1 = "token_endpoint" ascii nocase
        $s2 = "userinfo_endpoint" ascii nocase
        $s3 = "169.254.169.254" ascii
        $s4 = "127.0.0.1" ascii
        $s5 = "localhost" ascii nocase
        $s6 = "internal-connection" ascii nocase
        $s7 = "oauth" ascii nocase

    condition:
        (uint16(0) == 0x7B7B or uint16(0) == 0x7B0A or uint16(0) == 0x0A7B) and
        (2 of ($s1, $s2, $s7)) and
        (any of ($s3, $s4, $s5, $s6))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96259 Mattermost OAuth SSRF Attempt - Internal Endpoint Configuration"; flow:to_server,established; content:"POST"; http_method; content:"/api/v4/config"; http_uri; content:"oauth"; http_client_body; content:"169.254.169.254"; http_client_body; nocase; sid:1000001; rev:1; reference:cve,2026-96259; classtype:attempted-recon;)

Elastic Detection

sequence by user.id with maxspan=5m
  [ configuration where event.action == "config_update" and
      (configuration.setting : "oauth.token_endpoint" or configuration.setting : "oauth.userinfo_endpoint") and
      (configuration.new_value : "*169.254.169.254*" or configuration.new_value : "*127.0.0.1*" or configuration.new_value : "*10.*" or configuration.new_value : "*192.168.*" or configuration.new_value : "*172.16.*" or configuration.new_value : "*172.17.*" or configuration.new_value : "*172.18.*" or configuration.new_value : "*172.19.*" or configuration.new_value : "*172.2*" or configuration.new_value : "*172.30.*" or configuration.new_value : "*172.31.*") ]

Splunk SPL Query

index=mattermost sourcetype=mattermost:audit
| search event_type="config_update" AND (config_section="oauth" OR config_section="OAuth")
| rex field=config_value "(?i)(token_endpoint|userinfo_endpoint)\s*[=:]\s*(?<oauth_url>[^\s\"]+)"
| where match(oauth_url, "127\.0\.0\.1|169\.254\.169\.254|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.")
| stats count min(_time) as first_seen max(_time) as last_seen values(oauth_url) as urls values(user_id) as users by host
| where count > 0

Wazuh OSSEC Rule

<group name="mattermost,">
  <rule id="100200" level="10">
    <decoded_as>json</decoded_as>
    <field name="event">config_update</field>
    <field name="config_section">oauth</field>
    <regex field="config_value">(127\.0\.0\.1|169\.254\.169\.254|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)</regex>
    <description>Mattermost CVE-2026-96259: OAuth endpoint configured with internal network address</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict System Administrator privileges to trusted personnel only and enforce multi-factor authentication for all admin accounts.
   • Monitor audit logs for changes to OAuth token or userinfo endpoint configurations, especially those pointing to private IP ranges.
   • Implement network-level egress filtering on the Mattermost server to block outbound requests to internal RFC 1918 addresses, loopback, and link-local metadata endpoints.
   • If OAuth is not required, disable the OAuth integration entirely to remove the attack surface.

2. Patch/upgrade steps:

   • No vendor patch is available as of this report. Monitor Mattermost security advisories and the MMSA-2026-00776 advisory for a fix.
   • Prepare to upgrade to the first patched version once released. Given the affected version branches, the fix is expected in 11.9.2, 11.8.6, 11.7.11, and 11.10.2 or later. Do not upgrade until the vendor confirms the fix.
   • Subscribe to Mattermost security notifications and CVE feeds for updates.

3. Long-term hardening:

   • Enforce the principle of least privilege for all Mattermost roles, particularly System Administrator.
   • Deploy a Web Application Firewall (WAF) or reverse proxy that validates outbound URL destinations from application server components.
   • Conduct regular security reviews of OAuth and integration configurations.
   • Implement network segmentation to limit the blast radius of SSRF vulnerabilities.
   • Adopt a vulnerability management program that tracks CVE disclosures and applies patches promptly.

References

• NVD — CVE-2026-96259: https://nvd.nist.gov/vuln/detail/CVE-2026-96259
• Mattermost Security Advisory MMSA-2026-00776: https://mattermost.com/security-updates/
• CWE-918: Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (not yet scored): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence have been identified for this CVE at the time of writing.