CVE-2026-2476 MS Teams plugin sensitive config values not properly masked in support packets
Attackers with access to support packets can obtain unmasked sensitive plugin configuration values from Mattermost plugins.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2476?
CVE-2026-2476 is a high-severity vulnerability in Mattermost, published on 16 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606
Weakness: CWE-200
Which versions are affected by CVE-2026-2476?
3 open source packages ship an affected version, including github.com/mattermost/mattermost-plugin-msteams. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/mattermost/mattermost-plugin-msteams Go | All versions | 1.15.1-0.20260102165339-036c761bd3cb |
github.com/mattermost/mattermost-plugin-msteams Go | All versions | 1.15.1-0.20260102165339-036c761bd3cb |
github.com/mattermost/mattermost-plugin-msteams Go | All versions | 1.15.1-0.20260102165339-036c761bd3cb |
Products include Mattermost Ms Teams.
How do I fix CVE-2026-2476?
Upgrade github.com/mattermost/mattermost-plugin-msteams to 1.15.1-0.20260102165339-036c761bd3cb or later.
Is CVE-2026-2476 being exploited?
There is no known exploitation of CVE-2026-2476 in the wild and no public exploit code.
Sources
Also known as GHSA-4ppj-6chv-5pgc, GO-2026-4784.