Non évaluée
Admin RCE via Malicious Plugin Upload on CI Test Instances
CVE-2026-2462
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to restrict plugin installation on CI test instances with default admin credentials which allows an unauthenticated attacker to achieve remote code execution and exfiltrate sensitive configuration data including AWS and SMTP credentials via uploading a malicious plugin after changing the import directory. Mattermost Advisory ID: MMSA-2025-00528
Références
- advisory github.com
- advisory mattermost.com
- advisory nvd.nist.gov