CVE-2026-9699 - Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors · CoreCVE

Back Back to CVE browser

MEDIUM

Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors

Published Jun 26, 2026

6.8

MEDIUM

CVSS 3.1

EPSS 0.46%

Description

Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with access to server logs or support packets to obtain a valid or partially reconstructable OpenAI API key via inspection of mattermost.log entries generated during authentication failures. Mattermost Advisory ID: MMSA-2026-00609

Affected products

Vendor Mattermost Product Mattermost Default
unaffected
Affected
- ≥ 0, ≤ 10.18.11
- ≥ 0, ≤ 11.3.6
- ≥ 0, ≤ 11.6.5
Unaffected
- 10.11.19
- 11.5.7
- 11.6.4
- 11.7.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Mattermost	Mattermost	unaffected	Affected ≥ 0, ≤ 10.18.11 ≥ 0, ≤ 11.3.6 ≥ 0, ≤ 11.6.5 Unaffected 10.11.19 11.5.7 11.6.4 11.7.0

Remediation

Vendor solution

Update Mattermost Plugins to versions 11.7.0, 10.11.19, 11.6.4, 11.5.7 or higher.

Weaknesses (1)

CWE-532

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39778
Advisory
https://mattermost.com/security-updates
vendor-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39778		Advisory
https://mattermost.com/security-updates		vendor-advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Mattermost

Published Jun 26, 2026

Updated Jun 26, 2026

Reserved May 27, 2026

Link CVE-2026-9699

CISA Vulnrichment

Updated Jun 26, 2026

NVD

Status Awaiting Analysis

Modified Jun 26, 2026

Link CVE-2026-9699

Red Hat

No data

ENISA EUVD

Assigner Mattermost

Published Jun 26, 2026

Updated Jun 26, 2026

Link EUVD-2026-39778

GitHub

No data