3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-6333

CVE-2026-6333: Mattermost doesn't validate the Host header when constructing response URLs for custom slash command

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an attacker-controlled server via a spoofed Host header.. Mattermost Advisory ID: MMSA-2026-00582

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-6333

CVE-2026-6333:

3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 11.5.0, < 11.5.2	11.5.2
github.com/mattermost/mattermost/server/v8	go	>= 10.11.0, < 10.11.14	10.11.14
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20260325160634-e738016c5920	8.0.0-20260325160634-e738016c5920
github.com/mattermost/mattermost-server	go	< 5.3.2-0.20260325160634-e738016c5920	5.3.2-0.20260325160634-e738016c5920

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because Mattermost failed to validate the Host header when constructing response URLs for custom slash commands. An analysis of the provided patch commit e738016c592045e14bf926eafaeda6f8521def6d reveals changes in two key functions that address this issue.

In server/channels/app/command.go, the function App.tryExecuteCustomCommand was modified. Previously, it constructed a response_url using args.SiteURL, a value derived from the incoming HTTP request's Host header. This allowed an attacker to craft a request with a spoofed Host header, causing the slash command's response to be sent to an arbitrary URL. The fix replaces the use of args.SiteURL with the server's pre-configured *a.Config().ServiceSettings.SiteURL, ensuring that the response URL is always based on a trusted, administrator-defined value.
In server/channels/app/command_autocomplete.go, the function App.getDynamicListArgument was also changed. This function makes a request to a plugin's FetchURL for autocomplete suggestions. The original code passed commandArgs.SiteURL (from the Host header) as a site_url parameter in this request. This could be exploited to manipulate the request sent to the plugin. The patch ensures that the configured SiteURL is used instead, preventing this vector of attack.

The root cause is improper trust in the Host header for generating critical URLs. The identified functions, App.tryExecuteCustomCommand and App.getDynamicListArgument, are the points where this untrusted data was used, making them the vulnerable functions that would appear in a runtime profile during exploitation.

Vulnerable functions

App.tryExecuteCustomCommand

server/channels/app/command.go

The function `tryExecuteCustomCommand` was vulnerable because it used `args.SiteURL`, which is derived from the user-controlled `Host` header, to construct the `response_url` for a custom slash command. This allowed an attacker to specify a malicious URL for the slash command response, leading to a server-side request forgery (SSRF) vulnerability where the response is sent to an attacker-controlled server. The patch fixes this by using the server's configured `SiteURL` instead.

App.getDynamicListArgument

server/channels/app/command_autocomplete.go

The function `getDynamicListArgument` was vulnerable because it passed the `commandArgs.SiteURL`, derived from the user-controlled `Host` header, as a parameter in a request to a plugin's `FetchURL`. This could allow an attacker to influence the `site_url` parameter sent to the plugin, potentially leading to SSRF or other issues within the plugin. The patch mitigates this by using the server's configured `SiteURL`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.