CVE-2026-3472: Mattermost AI Bot Data Exfiltration via Markdown Image Injection

Technical summary

Mattermost fails to enforce markdown image rendering restrictions consistently across AI bot tool result posts. An authenticated attacker can inject markdown image syntax (e.g., ) into tool result content. When a victim's client renders the post, the browser executes the image fetch, sending an HTTP request to the attacker's server. This request includes cookies and context that may leak information about the victim's session or client state. The vulnerability affects versions 10.11.x through 10.11.18, 11.5.x through 11.5.6, and 11.6.x through 11.6.3. The root cause maps to CWE-693 (Protection Mechanism Failure), indicating improper validation or restriction of dangerous content.

Business impact

Data exfiltration risk is the primary concern. Attackers with Mattermost accounts—whether legitimate employees, contractors, or compromised accounts—can harvest session tokens, user identifiers, IP addresses, or other client-side data from teammates. In regulated industries (healthcare, finance, legal), this may trigger breach notification obligations. The attack requires victim interaction and a valid account, so blast radius is constrained to authenticated users within the Mattermost workspace. Organizations relying on Mattermost for sensitive communications should prioritize patching to prevent potential compliance violations and loss of confidential information.

Affected systems

Mattermost Server is affected across three release branches: 10.11.x (up to and including 10.11.18), 11.5.x (up to and including 11.5.6), and 11.6.x (up to and including 11.6.3). Organizations running any of these versions with AI bot tool integrations enabled face exposure. The vulnerability does not affect earlier major versions (e.g., 9.x, 10.0–10.10.x) or patched versions of the affected branches. Verify your running version via System Console > About > Mattermost Version.

Exploitability

Exploitation requires three conditions: (1) valid Mattermost account access, (2) ability to control or influence AI bot tool result content, and (3) victim interaction with the malicious post. Attackers cannot exploit this remotely without authentication. However, in organizations where AI bots are widely used and trusted, users may not scrutinize bot-generated content closely, reducing friction. The CVSS score of 3.5 (LOW) reflects the authentication requirement and user-interaction dependency. No public exploit code or active exploitation has been reported.

Remediation

Patch immediately to versions that enforce markdown image rendering restrictions on AI bot tool results. For affected branches, upgrade to: Mattermost 10.11.19 or later (10.11.x line), 11.5.7 or later (11.5.x line), or 11.6.4 or later (11.6.x line). Verify patch versions against the official Mattermost advisory (MMSA-2026-00619). If upgrading is not immediately feasible, disable AI bot tool integrations or restrict their use to trusted automation until patching is complete.

Patch guidance

Mattermost recommends upgrading to patched releases that validate and restrict markdown image syntax in AI bot tool output. Download the appropriate version from the Mattermost release repository. Test patches in a staging environment first, particularly if you have custom AI bot integrations or plugins. The upgrade process typically requires a service restart; schedule maintenance during a low-activity window. Verify post-upgrade that AI bots continue to function correctly and that markdown rendering behaves as expected. Consult the official Mattermost advisory (MMSA-2026-00619) for any version-specific migration notes.

Detection guidance

Monitor Mattermost audit logs for posts containing suspicious markdown image syntax, especially those attributed to AI bots or tool integrations. Search for patterns like '![' followed by URLs pointing to external servers. Inspect HTTP access logs on your edge firewall or proxy for unexpected outbound requests to unfamiliar domains originating from Mattermost client IPs. Consider enabling debug logging on Mattermost to capture markdown processing events. User reports of unexpected browser requests or warnings during Mattermost use may indicate exposure. If you have SIEM integration, create alerts on abnormal external HTTP requests from Mattermost server or client processes.

Why prioritize this

Although the CVSS score is LOW, this vulnerability should be addressed promptly because it enables data exfiltration in a collaborative communication platform where users may not expect client-side code execution. The reliance on user interaction and authentication limits severity but does not eliminate risk—trusted bot content has a higher chance of being viewed without suspicion. Organizations handling sensitive communications, IP, or personally identifiable information should prioritize patching before attackers develop scalable exploitation tactics. Given the relatively low cost of upgrading, this is a good candidate for near-term remediation in any organization running affected versions.

Risk score, explained

CVSS 3.5 (LOW) is justified by the combination of network accessibility (AV:N), low complexity (AC:L), and the requirement for prior authentication (PR:L) and user interaction (UI:R). The impact is limited to confidentiality (C:L) with no integrity or availability loss. However, the practical risk depends on organizational context: teams with high AI bot adoption and sensitive data face elevated real-world risk despite the low base score. Consider increasing priority if your organization handles regulated data or has a history of account compromise.

Frequently asked questions