CVE-2026-96260

Executive Summary

CVE-2026-96260 is a denial-of-service vulnerability affecting Mattermost server versions 11.7.x through 11.10.x (specifically 11.7.x <= 11.7.10, 11.8.x <= 11.8.5, 11.9.x <= 11.9.1, and 11.10.x <= 11.10.1). The flaw, tracked by Mattermost as MMSA-2026-00775, stems from a failure to enforce a request body size limit during CSRF validation of plugin requests (CWE-789: Memory Allocation with Excessive Size Value). Any authenticated user can send an oversized request body to a plugin endpoint, causing uncontrolled memory allocation that can exhaust server memory and render the instance unavailable. With a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the vulnerability requires only low-privileged authenticated access, making it exploitable by any user who can obtain a valid account on the affected instance.

Technical Analysis

The vulnerability resides in the CSRF validation path applied to plugin requests. Per the NVD description, affected Mattermost versions "fail to enforce a request body size limit during CSRF validation of plugin requests." This means the code path that validates CSRF tokens for plugin-facing endpoints processes or buffers the incoming request body without first checking its declared or actual size against a configured maximum.

CWE-789 ("Memory Allocation with Excessive Size Value") accurately describes the mechanism: the application allocates memory proportional to an attacker-supplied size value. Because the size constraint is absent specifically during CSRF validation, an attacker does not need to bypass authentication or CSRF protections — they only need to be an authenticated user capable of reaching a plugin endpoint. The CSRF validation logic itself becomes the memory sink.

From an attack-surface perspective, Mattermost plugins expose HTTP endpoints that are reachable by authenticated users. When a request is sent to such an endpoint, the server performs CSRF validation before (or as part of) handling the request. The absence of a body-size limit at this stage means the server will read/allocate for the body without an upper bound, subject only to lower-level transport or runtime constraints. A sufficiently large body — or repeated moderately large bodies — drives memory consumption upward, degrading performance and, at scale, causing an out-of-memory condition that takes the service down.

Several important technical boundaries must be stated precisely, as the available description does not specify them:

• The exact plugin endpoint path(s) involved are not disclosed in the NVD description; no specific URL is named.
• The precise code function or middleware responsible for size enforcement is not identified in the available data.
• The mechanism by which "CSRF validation" specifically (as opposed to general request parsing) fails to enforce the limit is not detailed beyond the description.
• Whether exploitation requires a single large request or many concurrent requests is not specified; both are plausible given the class of flaw.

Analysts should therefore treat this as a resource-exhaustion flaw in the request-handling path for plugin endpoints, exploitable by an authenticated principal, with impact limited to availability (C:N/I:N/A:H). There is no evidence of confidentiality or integrity impact in the CVSS vector, and no evidence of remote code execution or data exfiltration.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-96260. The attack chain below is inferred strictly from the vulnerability class (CWE-789, uncontrolled memory allocation) and the NVD description. No specific function names, endpoint paths, or parameter names beyond those in the description are asserted.

1. Reconnaissance / target identification: An attacker identifies a reachable Mattermost instance running an affected version. This can be done via version disclosure, banner grabbing, or the Shodan dorks above (e.g., http.title:"Mattermost"). The attacker then obtains valid credentials for any account on the instance — self-registration, a compromised low-privilege account, or a guest account all suffice, because the flaw requires only PR:L (low privileges). No administrative rights are needed.

2. Triggering the flaw: Using the authenticated session, the attacker directs a request to a plugin endpoint. The critical condition, per the description, is that the request body is excessively large and that CSRF validation fails to enforce a body-size limit for plugin requests. The attacker therefore constructs a request with a very large body and submits it to the plugin endpoint. Because the size limit is not enforced during CSRF validation, the server accepts and processes/allocates for the oversized body.

3. Payload/execution at the vulnerability-class level: The "payload" here is not a code-execution payload but a volumetric one — a large request body whose size value drives an oversized memory allocation (CWE-789). The attacker may send a single very large body or multiple concurrent oversized bodies to amplify memory pressure. CSRF validation is the path where the missing limit manifests, so the attacker does not need to defeat CSRF protections; the validation itself is the vector.

4. Post-exploitation impact: The consequence is memory exhaustion. Server memory consumption rises with the size and/or volume of malicious bodies, degrading responsiveness and potentially causing an out-of-memory failure that takes the Mattermost instance offline. The CVSS vector (C:N/I:N/A:H) confirms impact is confined to availability — high availability impact, no confidentiality or integrity impact. There is no persistence, lateral movement, or data theft inherent to this flaw.

Chain summary: authenticated user → oversized request body to plugin endpoint → CSRF validation without body-size limit → uncontrolled memory allocation → memory exhaustion → denial of service. The attack is low complexity (AC:L) and requires no user interaction (UI:N).

Impact Assessment

The business impact of CVE-2026-96260 is availability-centric. Mattermost is widely deployed as a self-hosted team collaboration and messaging platform, frequently handling sensitive operational communications, incident response coordination, and internal knowledge exchange. A denial-of-service condition on a Mattermost instance can:

• Disrupt real-time incident response and security team coordination if the platform is used for alerting or on-call communication.
• Interrupt business messaging and file/plugin workflows that depend on the server being online.
• Consume remediation resources, as restarting or recovering a memory-exhausted instance carries operational cost and potential data-in-flight loss.

Blast radius is determined by the number of users, plugins, and integrations depending on a single Mattermost deployment. Because the attacker needs only authenticated low-privilege access (PR:L) over the network (AV:N) with no user interaction (UI:N), the pool of potential attackers is effectively any user with an account — including a malicious insider, a compromised low-privilege account, or an attacker who successfully self-registers or phishing-obtains credentials. The CVSS subscores — Confidentiality: None, Integrity: None, Availability: High — mean the primary exposure is service downtime, not data compromise. However, secondary risk arises if downtime prevents detection or response to other concurrent incidents.

No CISA KEV listing and no known exploit-in-the-wild evidence exist for this CVE. EPSS has not yet been scored by FIRST.org; no EPSS value should be assumed. Affected-version data supplied to this report is empty, but the NVD description enumerates the impacted ranges (11.7.x <= 11.7.10, 11.8.x <= 11.8.5, 11.9.x <= 11.9.1, 11.10.x <= 11.10.1).

Detection Guidance

Sigma Rule

title: Potential Mattermost Plugin Endpoint Memory Exhaustion (CVE-2026-96260)
id: 7f3c1a92-4b8e-4d61-9a2e-0c5f8d1e6b47
status: experimental
description: Detects oversized request bodies directed at Mattermost plugin endpoints that may indicate exploitation of the missing CSRF-based body size limit (CVE-2026-96260).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96260
  - https://mattermost.com/security-updates/
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1499
  - cve.2026-96260
logsource:
  category: webserver
  product: mattermost
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/plugins/'
  selection_size:
    sc-bytes|gte: 10485760
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
  condition: selection_endpoint and selection_size and selection_method
falsepositives:
  - Legitimate large file uploads to plugins with documented large-body requirements
level: medium

YARA Rule

rule CVE_2026_96260_Mattermost_PLUGIN_OVERSIZE_BODY
{
    meta:
        author      = "valtersit.com"
        description = "Detects volumetric request bodies aimed at Mattermost plugin endpoints associated with CVE-2026-96260"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-96260"
        cve         = "CVE-2026-96260"
        date        = "2026-01-01"

    strings:
        $plugin_path = "/plugins/" ascii wide nocase
        $csrf_hdr    = "X-CSRF-Token" ascii wide nocase
        $mm_method   = "POST /plugins/" ascii wide nocase

    condition:
        filesize > 10MB and any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96260 Mattermost plugin endpoint oversized request body possible DoS"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/plugins/"; http.request_body; dsize:>10000000; classtype:attempted-dos; reference:cve,2026-96260; reference:url,mattermost.com/security-updates/; sid:202696260; rev:1;)

Elastic Detection

sequence by user.name with maxspan=2m
  [ network where network.protocol == "http" and
      http.request.method in ("POST","PUT","PATCH") and
      url.path : "/plugins/*" and
      http.request.body.bytes > 10000000 ]

Splunk SPL Query

index=web sourcetype=mattermost OR sourcetype=access_combined
| search uri_path="*//plugins/*" method IN ("POST","PUT","PATCH")
| where bytes > 10000000
| stats count min(bytes) as min_bytes max(bytes) as max_bytes sum(bytes) as total_bytes
        by src_ip, uri_path
| where count >= 3 OR max_bytes > 20000000
| sort - total_bytes
| table src_ip, uri_path, count, min_bytes, max_bytes, total_bytes

Wazuh OSSEC Rule

<group name="mattermost,web,attack,">
  <rule id="2026962" level="10">
    <decoded_as>json</decoded_as>
    <field name="method">POST|PUT|PATCH</field>
    <field name="url">\/plugins\/</field>
    <field name="bytes">&#62;</field>
    <description>CVE-2026-96260: Possible Mattermost plugin endpoint memory-exhaustion attempt (oversized request body)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,cve_2026_96260,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence has been identified from any tracked source, and no vendor fix or workaround is available in the supplied data. The following guidance is therefore precautionary and subject to change once Mattermost publishes a fix under MMSA-2026-00775.

1. Immediate mitigations (without a vendor patch):

   • Enforce request body size limits at the reverse proxy / API gateway tier in front of Mattermost (e.g., nginx client_max_body_size, Envoy/HAProxy body-size constraints). A conservative limit aligned to legitimate plugin upload needs will blunt volumetric abuse.
   • Restrict plugin availability: disable or remove non-essential plugins, and limit which endpoints are externally reachable. Fewer live plugin endpoints reduce attack surface.
   • Tighten identity controls: enforce strong authentication, disable open self-registration where feasible, and remove or disable guest/dormant accounts to reduce the pool of principals who can trigger the flaw (PR:L).
   • Apply rate limiting per authenticated user/IP at the edge to constrain concurrent oversized submissions.

2. Patch/upgrade steps:

   • Monitor the Mattermost security updates page and MMSA-2026-00775 for an official fixed release. No specific patched version is known at this time.
   • When a fix is published, upgrade all affected ranges (11.7.x <= 11.7.10, 11.8.x <= 11.8.5, 11.9.x <= 11.9.1, 11.10.x <= 11.10.1) to the recommended version and validate that the body-size enforcement during CSRF validation is restored.
   • Stage upgrades in a non-production environment and confirm plugin functionality post-upgrade.

3. Long-term hardening:

   • Standardize edge-layer body-size and rate limits for all collaboration platforms, treating them as defense-in-depth against resource-exhaustion classes (CWE-789).
   • Implement memory and resource monitoring/alerting on Mattermost hosts to detect anomalous allocation spikes early.
   • Adopt a least-privilege account model and periodic access reviews to shrink the authenticated attacker population.
   • Integrate CVE monitoring for all deployed Mattermost versions into vulnerability management workflows.

References

• NVD — CVE-2026-96260: https://nvd.nist.gov/vuln/detail/CVE-2026-96260
• Mattermost Security Updates (MMSA-2026-00775): https://mattermost.com/security-updates/
• CWE-789 — Memory Allocation with Excessive Size Value: https://cwe.mitre.org/data/definitions/789.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA Known Exploited Vulnerabilities Catalog (no listing for this CVE as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaign data: none identified. There is no CISA KEV entry, no public PoC, no Nuclei template, and no exploit-in-the-wild evidence for CVE-2026-96260 at the time of writing. EPSS remains unscored by FIRST.org.