7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-6347

CVE-2026-6347: Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker with access to a support packet to obtain TURN server credentials via the plaintext values present in the exported plugin configuration.. Mattermost Advisory ID: MMSA-2026-00605

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-6347

CVE-2026-6347:

7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	>= 11.5.0, < 11.5.2	11.5.2
github.com/mattermost/mattermost-server	go	>= 10.11.0, < 10.11.14	10.11.14
github.com/mattermost/mattermost-server	go	>= 11.4.0, < 11.4.4	11.4.4
github.com/mattermost/mattermost-plugin-calls	go	< 1.12.0-rc2	1.12.0-rc2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-6347, is an information disclosure issue in the Mattermost Calls plugin. Sensitive configuration fields, specifically ICEServersConfigs and TURNStaticAuthSecret, were not being sanitized when a support packet was generated. This resulted in TURN server credentials being exposed in plaintext. The root cause of the vulnerability was that these fields were not marked as secret in the plugin's configuration file, plugin.json.

The patch, identified by commit d48893c8558e5a61f5fdd188bbee5ec7cb73887b, rectifies this by adding the "secret": true property to these fields in plugin.json. This change signals to the Mattermost server that these values should be redacted from any exported data, including support packets.

While the primary fix is in the plugin.json configuration file, the patch also modifies the SetDefaults function in server/configuration.go. This function is responsible for setting default values for the plugin's configuration. The change in this function reduces the default expiration time for TURN credentials, which is a security hardening measure. Although SetDefaults is not the function that leaks the data, it is the only Go function modified in the patch and is part of the plugin's configuration lifecycle. Therefore, it is identified as a low-confidence runtime indicator that would be present in a profiler trace when the plugin's configuration is initialized or updated.

Vulnerable functions

configuration.SetDefaults

server/configuration.go

This function is responsible for setting the default configuration values for the Mattermost Calls plugin. It was modified as part of the security patch to reduce the default expiration time for TURN credentials. While this function itself does not leak the sensitive information, it is part of the configuration handling process. The actual vulnerability lies in the lack of sanitization of sensitive fields when the configuration is exported, which is corrected by marking fields as 'secret' in the plugin.json file. This function would be executed when the plugin is activated or its configuration is changed, making it a relevant runtime indicator.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.