Mattermost Microsoft Teams Plugin fails to properly mask sensitive configuration values

MEDIUM 4.3CVE-2026-2476 · GHSA-4ppj-6chv-5pgc · GO-2026-4784 · Published 16/03/2026 · updated 17/06/2026

In short

CVE-2026-2476 is a MEDIUM (CVSS 4.3) vulnerability affecting github.com/mattermost/mattermost-plugin-msteams, ms teams (mattermost).
Chance of exploitation in the next 30 days (EPSS): 0.19%, higher than 8.3% of all vulnerabilities.
Fix: update to 1.15.1-0.20260102165339-036c761bd3cb, 2.3.1 or later.

Package	Affected versions	Patched versions
github.com/mattermost/mattermost-plugin-msteams Go	`< 1.15.1-0.20260102165339-036c761bd3cb`	`1.15.1-0.20260102165339-036c761bd3cb`
ms teams mattermost	`< 2.3.1`	`2.3.1`

Description

Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2026-2476 · ADVISORY
mattermost/mattermost-plugin-msteams commit 036c761 · WEB
mattermost/mattermost-plugin-msteams · PACKAGE
mattermost.com/security-updates · WEB
GitHub Advisory GHSA-4ppj-6chv-5pgc · ADVISORY

More vulnerabilities in github.com/mattermost/mattermost-plugin-msteams

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/mattermost/mattermost-plugin-msteams

< 1.15.1-0.20260102165339-036c761bd3cb

1.15.1-0.20260102165339-036c761bd3cb

ms teams

mattermost

< 2.3.1

2.3.1

Description

NVD description

More vulnerabilities in github.com/mattermost/mattermost-plugin-msteams

See all →