CVE-2026-6517 Mattermost Desktop NTLM Credential Leakage Vulnerability

Technical summary

CVE-2026-6517 stems from improper domain validation in NTLM credential handling within Mattermost Desktop App. The vulnerability allows an authenticated attacker to craft a malicious message containing an image tag with a src attribute pointing to an attacker-controlled external server. When recipients view the message, the desktop app automatically attempts NTLM authentication against the attacker's server without verifying that the domain is on an approved allowlist. This credential exposure occurs only when the image proxy feature is disabled, which may be the default or common configuration in some deployments. The issue is mapped to CWE-522 (Insufficient Logging), though the core mechanism involves broken access control over credential forwarding.

Business impact

Successful exploitation results in plaintext or hash-based NTLM credential capture from Desktop App users. An attacker gaining valid NTLM hashes can attempt offline cracking or relay attacks to gain unauthorized access to other systems within the organization's network, including file servers, web applications, or lateral movement opportunities. The attack requires only message visibility and no special privileges, making it applicable across organizations using Mattermost for internal communication. Reputational risk and compliance violations may result if sensitive credentials are exposed.

Affected systems

Mattermost Desktop App version 6.1 and all earlier versions are vulnerable, including 5.5.13.0 and below. The vulnerability applies only to deployments where the image proxy feature is not enabled. Organizations using Mattermost Desktop should verify their current version and proxy configuration. Server-side administrators should check if image proxy is active; users accessing Mattermost primarily through web browsers are not directly impacted.

Exploitability

Exploitation requires authenticated access to a Mattermost server (low barrier for internal users), the ability to post or embed messages, and knowledge that the target user runs a vulnerable Desktop App version without image proxy enabled. The attacker must also host a web server to receive credential requests. The attack is non-interactive from the victim's perspective—simply viewing a message triggers credential forwarding—but requires relatively specific deployment conditions. Network position is not required, as the attack occurs over standard HTTP/HTTPS channels.

Remediation

Upgrade Mattermost Desktop App to a patched version released after June 2026. Verify the specific patched release against the Mattermost advisory (MMSA-2026-00651) and vendor security announcements. As an interim mitigation, enable the image proxy feature on the Mattermost server to restrict external image loading. Users unable to patch immediately should avoid viewing messages from untrusted senders or temporarily disable the Desktop App in favor of web-based access if possible.

Patch guidance

Contact Mattermost or monitor their official security advisories for the patched Desktop App version corresponding to MMSA-2026-00651. Deployment should include updating all Desktop App installations across client machines; consider using centralized software deployment tools or mobile device management solutions to enforce the update. Test the patched version in a non-production environment first to confirm compatibility with your Mattermost server version and organizational integrations.

Detection guidance

Log and monitor outbound NTLM authentication attempts from Desktop App processes to unknown or external domains. Network detection can focus on NTLM traffic (ports 80, 443, or non-standard ports) originating from internal machines to external IPs. Endpoint detection and response (EDR) tools should track process-level image loading and authentication events. Review Mattermost server logs for messages containing external image sources pointing to suspicious domains. If image proxy is enabled, verify it is actively filtering and blocking such requests.

Why prioritize this

This vulnerability merits medium-to-high priority patching despite its CVSS score of 6.3 (Medium) because credential harvesting poses significant business risk. The attack is trivially easy to execute once deployed and affects all users without image proxy protection. The lack of user interaction beyond viewing a message and the wide applicability across internal users elevate the practical risk. Organizations relying on NTLM authentication for network access should treat this as critical; those using alternative authentication schemes (e.g., Kerberos, OAuth) face reduced but non-zero risk.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects the requirement for authenticated access to the Mattermost server (PR:L) and relatively high attack complexity due to the image proxy configuration dependency (AC:H). However, the score does not fully capture the organizational impact of credential harvesting, particularly in environments where NTLM is a primary network authentication vector. The high confidentiality impact (C:H) reflects credential exposure, while integrity and availability remain unaffected. Consider supplementing CVSS with qualitative risk assessment based on your deployment's reliance on NTLM and the prevalence of Desktop App usage.

Frequently asked questions