CVE-2026-10556: Mattermost Calendar Plugin DoS Vulnerability

CVE-2026-10556 Overview

CVE-2026-10556 affects multiple Mattermost server versions that ship with the Microsoft Calendar plugin. The vulnerability stems from missing validation of null entries in Microsoft Graph webhook notification payloads. An unauthenticated attacker can send a crafted POST request to the public webhook endpoint and crash the Microsoft Calendar plugin process. The result is a denial of service for calendar integration across all users on the affected instance. Mattermost tracks this issue as advisory MMSA-2026-00693 and categorizes it under CWE-754, improper check for unusual or exceptional conditions.

Critical Impact
An unauthenticated network attacker can disable the Microsoft Calendar integration on vulnerable Mattermost instances by sending a single malformed webhook request.

Affected Products

Mattermost 11.9.x versions <= 11.9.0
Mattermost 11.8.x versions <= 11.8.4, and 11.7.x versions <= 11.7.7
Mattermost 10.11.x versions <= 10.11.22

Discovery Timeline

2026-09-14 - CVE-2026-10556 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-10556

Vulnerability Analysis

The Mattermost Microsoft Calendar plugin exposes a public webhook endpoint that receives change notifications from Microsoft Graph. The plugin processes incoming JSON payloads without checking whether required fields contain null values. When a request arrives with null entries where structured data is expected, the plugin fails to handle the exceptional condition and the plugin process crashes. Because the endpoint accepts unauthenticated requests by design (Microsoft Graph webhook validation is handled through validation tokens rather than session authentication), any remote attacker who can reach the endpoint can trigger the fault.

The crash affects the plugin process only, but calendar integration becomes unavailable to every user on the instance until the plugin is restarted. Repeated requests can hold the integration in a broken state.

Root Cause

The root cause is improper input validation, specifically the failure to check for null entries in webhook notification payloads before dereferencing them. This aligns with CWE-754, where the plugin does not guard against an exceptional condition (null field) that a well-formed but malicious payload can produce.

Attack Vector

Exploitation requires only network access to the Mattermost instance's public webhook endpoint for the Microsoft Calendar plugin. No credentials, user interaction, or elevated privileges are required. The attacker sends a crafted HTTP POST request containing null values in fields the plugin assumes are populated. Consult the Mattermost Security Updates page for advisory details.

No public proof-of-concept has been published. The EPSS probability at publication was low, reflecting the limited scope of impact (availability of a single plugin) rather than exploit complexity.

Detection Methods for CVE-2026-10556

Indicators of Compromise

Unexpected termination or restart events for the Mattermost Microsoft Calendar plugin process.
HTTP POST requests to the plugin's public webhook endpoint containing JSON payloads with null values in required fields.
Repeated calendar integration outages reported by users without corresponding administrative actions.

Detection Strategies

Monitor Mattermost server logs for plugin panic traces or plugin lifecycle events referencing the Microsoft Calendar plugin.
Inspect reverse-proxy or web application firewall logs for anomalous request patterns targeting the Microsoft Graph webhook path.
Correlate plugin crash events with recent inbound webhook traffic to identify likely trigger requests.

Monitoring Recommendations

Alert on plugin restart frequency exceeding a low baseline threshold within a short time window.
Rate-limit and log all requests to the calendar webhook endpoint at the network edge.
Track availability metrics for calendar integration and surface degradation to on-call staff.

How to Mitigate CVE-2026-10556

Immediate Actions Required

Upgrade Mattermost to a fixed release above 11.9.0, 11.8.4, 11.7.7, or 10.11.22 on the corresponding branch.
Restrict inbound access to the Microsoft Calendar webhook endpoint to Microsoft Graph source ranges where feasible.
Review plugin logs for prior crash events that may indicate exploitation attempts.

Patch Information

Mattermost has released fixed versions on each supported branch. Refer to the Mattermost Security Updates page and advisory MMSA-2026-00693 for the specific patched versions and upgrade guidance.

Workarounds

Disable the Microsoft Calendar plugin on affected instances until patching is complete.
Place a reverse proxy or web application firewall rule in front of the webhook endpoint to drop payloads containing null values in required fields.
Limit exposure of the webhook endpoint to trusted network ranges when calendar integration is not business-critical.

bash

# Configuration example: temporarily disable the plugin via the Mattermost CLI
mattermost plugin disable com.mattermost.mscalendar