7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-5740

CVE-2026-5740: Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users via a crafted binary WebSocket message sent to the public WebSocket endpoint.. Mattermost Advisory ID: MMSA-2026-00647

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-5740

CVE-2026-5740:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	= 11.6.0	11.6.1
github.com/mattermost/mattermost-server	go	>= 11.5.0, < 11.5.4	11.5.4
github.com/mattermost/mattermost-server	go	>= 11.4.0, < 11.4.5	11.4.5
github.com/mattermost/mattermost-server	go	>= 10.11.0, < 10.11.15	10.11.15
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20260410202636-17939826efa2	8.0.0-20260410202636-17939826efa2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an unauthenticated attacker to cause a denial of service by sending a specially crafted binary WebSocket message. The analysis of the provided patch commit 17939826efa20a97f087b3d390ec5136df350bae reveals that the fix is located in the server/channels/app/platform/web_conn.go file, within the WebConn.readPump function. This function is the primary loop for reading data from the WebSocket. The patch introduces a new check that explicitly rejects binary messages (msgType != websocket.TextMessage) if the connection is not authenticated (!wc.IsAuthenticated()). This indicates that the WebConn.readPump function was the entry point for the malicious payload. While the root cause is likely within the msgpack decoding library (as suggested by the go.mod and go.sum changes which update a forked msgpack library), the WebConn.readPump function is the function that would appear in a runtime profile as it's responsible for receiving and dispatching the incoming WebSocket frames. An exploit would trigger this function, which, prior to the patch, would then call the vulnerable decoding logic.

Vulnerable functions

WebConn.readPump

server/channels/app/platform/web_conn.go

The `readPump` function is responsible for reading messages from a WebSocket connection. The vulnerability lies in the fact that before the patch, this function would process msgpack-encoded binary frames from unauthenticated users. A malicious user could send a crafted binary message that, when decoded, would cause a large memory allocation, leading to a server crash and denial of service. The patch adds a check to reject binary messages from unauthenticated connections, thus preventing the vulnerable decoding path from being reached.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.