CVE-2026-2476
High
Description
Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606
SeverityHigh
CVSS7.6
Exploit probability—
Product
Mattermost Ms Teams
PublishedMar 16, 2026
First seenMar 16, 2026
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- mattermost ms_teams2.3.1 or later
- github.com/mattermost/mattermost-plugin-msteams1.15.1-0.20260102165339-036c761bd3cb or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mattermost ms_teams | v < 2.3.1 | 2.3.1 |
| github.com/mattermost/mattermost-plugin-msteamsGo | v < 1.15.1-0.20260102165339-036c761bd3cb | 1.15.1-0.20260102165339-036c761bd3cb |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.