CVE-2026-6673: Mattermost Atlassian Connect Authentication Bypass – Jira Integration Risk

Technical summary

The vulnerability stems from insufficient authentication validation of Atlassian Connect callbacks, specifically in the `/ac/installed` endpoint. Mattermost fails to properly verify callback authenticity during the initial installation handshake, which relies on a shared secret exchange. An authenticated attacker can POST a rogue sharedSecret to this endpoint while the integration is in a pending-install state, overwriting the legitimate secret. This breaks the HMAC-based signature verification that normally protects subsequent Atlassian callbacks, allowing an attacker to forge authenticated requests to Mattermost from the supposed Jira/Atlassian system. The issue is categorized as CWE-306 (Missing Authentication), indicating the core problem is absent or insufficient verification of the callback source.

Business impact

Jira-Mattermost integrations are widely used for incident management, project tracking, and cross-tool visibility. Exploitation allows an attacker to disrupt this integration—causing Jira notifications to fail, sync issues to malfunction, or forge fake Jira-originated messages within Mattermost. For organizations relying on this integration for critical workflows, the impact includes loss of real-time visibility, broken automation, and potential confusion or social engineering opportunities. Because the attacker must have valid Mattermost credentials, the risk is primarily from insider threats or accounts compromised through credential theft, phishing, or lateral movement.

Affected systems

Mattermost Server versions 11.7.0 and earlier in the 11.7.x line, 11.6.2 and earlier in 11.6.x, 11.5.5 and earlier in 11.5.x, and 10.11.17 and earlier in 10.11.x are vulnerable. Organizations running any of these versions with an active or pending Atlassian Connect / Jira Cloud integration are at risk. Verify your exact Mattermost version via the System Console (Settings > About) or by running `mattermost version` on the server.

Exploitability

Exploitation requires valid Mattermost user credentials (PR:L in the CVSS vector), making it a credential-dependent attack rather than a zero-day that any anonymous user can trigger. However, the attack surface is significant in any organization where user accounts exist—including low-privileged employees or contractors. The vulnerability is easiest to exploit when an administrator is actively installing or reconfiguring the Jira integration, since the /ac/installed endpoint is most vulnerable during the pending-install window. No public exploit code or in-the-wild activity has been reported (KEV status: not listed), but the straightforward nature of the attack (crafting a POST request with a malicious secret) makes it trivial to weaponize.

Remediation

Update Mattermost Server to patched versions: 11.7.1 or later, 11.6.3 or later, 11.5.6 or later, or 10.11.18 or later. Verify the exact patch version against the Mattermost security advisory MMSA-2026-00654 before deployment. Organizations unable to patch immediately should disable or temporarily remove the Atlassian Connect integration in Settings > Integrations > Atlassian Connect until patching is complete. Additionally, review Mattermost user access logs for suspicious POST requests to `/ac/installed` to detect any attempted exploitation.

Patch guidance

Download the patched version from Mattermost's official release page corresponding to your current release line. Before applying in production, test in a staging environment to ensure no conflicts with custom integrations or plugins. Mattermost updates typically do not require database migration for minor version increments, but always back up your Mattermost database and configuration before patching. Restart the Mattermost service after updating the binary. If you are running Mattermost in a containerized environment, pull the updated image tag (e.g., `mattermost:11.7.1`) and redeploy. Verify the patch by confirming the version in System Console and checking that Jira integration still functions correctly post-update.

Detection guidance

Monitor Mattermost audit logs and access logs for POST requests to `/ac/installed` from unexpected source IPs or at unusual times. Enable detailed logging for Atlassian Connect callbacks if available in your deployment. Check the `SharedSecret` field in your Jira integration configuration; if it has changed unexpectedly or does not match your initial setup, this may indicate exploitation. Monitor Jira webhook and callback logs for failed or rejected signatures, which would occur if the shared secret was tampered with. Use SIEM tools to correlate unusual authentication-related events in Mattermost with network traffic to `/ac/installed`.

Why prioritize this

Although the CVSS score is moderate (6.4), the vulnerability is prioritized for prompt patching because: (1) it undermines the integrity of a cross-platform integration that is critical for many organizations' incident response workflows; (2) exploitation requires only user-level credentials, which are common in organizations; (3) the fix is a straightforward version update with no known breaking changes; and (4) the attack surface is well-defined and easy to monitor. Teams running Jira-Mattermost integrations should patch within 30 days; others can follow their standard patch cadence.

Risk score, explained

CVSS 6.4 reflects a medium-severity integrity impact (I:H, A:H) that is mitigated by the requirement for authenticated access (PR:L, UI:R) and a higher attack complexity (AC:H, reflecting the need to exploit during a specific install window). The lack of confidentiality impact (C:N) further limits the score. The vulnerability is not a remote code execution or critical data breach vector, but it does enable tampering with integration data and disruption of cross-tool automation. The unscored factors—ease of exploitation, organizational reliance on Jira integration, and potential for insider threats—suggest this should not be deprioritized despite the medium score.

Frequently asked questions