CVE-2026-10080 Overview
CVE-2026-10080 is a denial-of-service vulnerability in Mattermost Server affecting the Boards (focalboard) plugin. The flaw stems from missing type validation on WebSocket command fields [CWE-704]. An authenticated user can send a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId value to crash the plugin process. The crash denies service to all Boards users on the affected instance. Mattermost tracks this issue as advisory MMSA-2026-00687.
Critical Impact
Any authenticated Mattermost user can crash the Boards plugin process by sending a single malformed WebSocket message, disrupting collaboration for all Boards users.
Affected Products
- Mattermost Server 11.7.x through 11.7.6
- Mattermost Server 10.11.x through 10.11.21
- Mattermost Server 11.8.x through 11.8.3
Discovery Timeline
- 2026-08-17 - CVE-2026-10080 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-10080
Vulnerability Analysis
Mattermost Boards handles real-time updates through a WebSocket channel that accepts plugin-scoped commands. The custom_focalboard_SUBSCRIBE_TEAM command instructs the server to subscribe a client to team-level Board events. The handler reads the teamId field from the incoming message and passes it into downstream logic that expects a string. When an attacker submits a value of a different JSON type, such as an integer, boolean, array, or object, the handler triggers an unrecoverable error inside the plugin process. The plugin process terminates and Boards functionality becomes unavailable to every user on the instance until the plugin restarts.
Root Cause
The root cause is an [CWE-704] incorrect type conversion or cast in the WebSocket command parser. The SUBSCRIBE_TEAM handler does not verify the JSON type of teamId before performing string operations on it. Because the parser trusts the client-supplied structure, any deviation from the expected schema propagates into the plugin runtime and produces a fatal error rather than a validation rejection.
Attack Vector
Exploitation requires network access to the Mattermost WebSocket endpoint and valid user credentials. No elevated privileges, no user interaction, and no prior team membership beyond a standard authenticated session are needed. The attacker opens a WebSocket connection, authenticates, and sends a single custom_focalboard_SUBSCRIBE_TEAM payload with teamId set to a non-string JSON value. The plugin process crashes on parse, and the impact affects all Boards users, not only the attacker.
No public proof-of-concept or exploit code is available for CVE-2026-10080. See the Mattermost Security Updates page for vendor technical details.
Detection Methods for CVE-2026-10080
Indicators of Compromise
- Unexpected termination or restart events for the focalboard plugin process in Mattermost server logs.
- WebSocket frames containing the action custom_focalboard_SUBSCRIBE_TEAM where teamId is not a JSON string.
- Repeated Boards service unavailability reports correlated with a single authenticated session.
Detection Strategies
- Inspect application logs for plugin panic traces or focalboard restart entries following WebSocket traffic bursts.
- Deploy a WebSocket-aware reverse proxy or WAF rule that validates JSON schema for custom_focalboard_* commands before forwarding them.
- Correlate authenticated user IDs with plugin crash timestamps to identify abusive sessions.
Monitoring Recommendations
- Alert on any Boards plugin process restart within a short interval, since normal operation should not produce repeated restarts.
- Track WebSocket error rates per user session and flag outliers that generate parsing exceptions.
- Forward Mattermost server and plugin logs to a centralized analytics pipeline for retention and query.
How to Mitigate CVE-2026-10080
Immediate Actions Required
- Upgrade Mattermost Server to a fixed release above 11.7.6, 10.11.21, or 11.8.3 according to your maintenance track.
- Audit account provisioning to ensure only trusted users can authenticate to the Mattermost instance during the patch window.
- Review server and plugin logs for prior plugin crashes that match the vulnerability pattern.
Patch Information
Mattermost has published fixes in versions above 11.7.6, 10.11.21, and 11.8.3. Refer to the Mattermost Security Updates advisory MMSA-2026-00687 for exact fixed version numbers and upgrade guidance.
Workarounds
- Disable the Boards (focalboard) plugin from the System Console until the server can be upgraded.
- Restrict WebSocket endpoint access to trusted networks using firewall or reverse-proxy rules where feasible.
- Enforce rate limits on authenticated WebSocket sessions to reduce repeat-crash impact.
# Disable the Boards plugin via the Mattermost CLI until patched
mattermost plugin disable focalboard
# Confirm the plugin is no longer active
mattermost plugin list
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
