CVE-2026-19601 Overview
CVE-2026-19601 affects multiple Mattermost releases where the server fails to invalidate a stored Active Directory/Lightweight Directory Access Protocol (AD/LDAP) bind password when related connection settings change. A System Console administrator can redirect the LDAP connection to an attacker-controlled server and trigger the Test Connection or diagnostics feature. The server then transmits the retained plaintext bind password to that external host, exposing privileged directory credentials. The flaw is tracked under Mattermost Advisory ID MMSA-2026-00764 and is classified as [CWE-201] Insertion of Sensitive Information Into Sent Data.
Critical Impact
A malicious or compromised System Console administrator can exfiltrate the plaintext AD/LDAP bind password to any attacker-controlled LDAP endpoint.
Affected Products
- Mattermost 11.9.x through 11.9.1
- Mattermost 11.8.x through 11.8.5, and 11.7.x through 11.7.10
- Mattermost 11.10.x through 11.10.1
Discovery Timeline
- 2026-10-16 - CVE CVE-2026-19601 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-19601
Vulnerability Analysis
Mattermost persists the AD/LDAP bind password in server configuration so administrators do not need to re-enter it when adjusting unrelated LDAP options. The vulnerable releases do not clear or re-validate this stored credential when the LDAP server address or other connection parameters change. As a result, the stored password remains bound to a new, potentially untrusted endpoint.
When an administrator invokes the Test Connection or diagnostics workflow, Mattermost initiates an LDAP bind against the configured server using the retained plaintext password. If the server address has been swapped to an attacker-controlled LDAP listener, that listener receives the bind credentials in cleartext during the bind exchange.
The issue requires System Console administrator privileges, which limits exploitation to insiders or attackers who have already compromised a privileged account. However, directory bind accounts frequently hold broad read access across the enterprise directory, so leakage expands the blast radius well beyond Mattermost itself.
Root Cause
The root cause is missing invalidation of a sensitive secret when its security context changes. Mattermost treats the bind password as persistent configuration rather than as a credential bound to a specific target server, so changing the destination does not force re-entry or revocation.
Attack Vector
An authenticated System Console administrator modifies the LDAP server address in System Console > Authentication > AD/LDAP to point at an attacker-operated LDAP server. The administrator then triggers Test Connection. Mattermost initiates an LDAP bind to the attacker endpoint, submitting the previously stored bind Distinguished Name and plaintext password. The attacker captures the credentials from the LDAP bind request.
The vulnerability does not require network-level interception because the Mattermost server itself delivers the credential to the attacker-chosen destination. No external code execution or memory corruption is involved. See the Mattermost Security Updates page for additional vendor detail.
Detection Methods for CVE-2026-19601
Indicators of Compromise
- Audit log entries showing LDAP server address or port changes in the System Console followed by Test Connection events within a short window.
- Outbound LDAP (TCP 389) or LDAPS (TCP 636) connections from Mattermost hosts to unexpected or external destinations.
- Configuration diffs on config.json showing changes to LdapSettings.LdapServer without corresponding changes to LdapSettings.BindPassword.
Detection Strategies
- Alert on any modification to AD/LDAP connection fields in Mattermost audit logs, especially address, port, or bind DN changes.
- Correlate configuration changes with subsequent TestLdap or diagnostics API calls originating from the same administrator session.
- Monitor egress traffic from Mattermost application servers and flag LDAP connections to hosts outside the sanctioned directory infrastructure.
Monitoring Recommendations
- Forward Mattermost audit logs and system logs to a centralized SIEM for retention and correlation.
- Baseline the expected LDAP destinations for each Mattermost deployment and alert on deviations.
- Review System Console administrator role assignments regularly and enforce multi-person approval for authentication configuration changes.
How to Mitigate CVE-2026-19601
Immediate Actions Required
- Upgrade Mattermost to a release that includes the fix for MMSA-2026-00764 as listed on the vendor advisory page.
- Rotate the AD/LDAP bind account password immediately if any unexpected LDAP server address change is found in audit logs.
- Restrict System Console administrator access to a minimal, audited set of operators.
Patch Information
Mattermost has issued fixes in releases subsequent to 11.9.1, 11.8.5, 11.7.10, and 11.10.1. Refer to the Mattermost Security Updates advisory for the exact fixed versions and upgrade guidance.
Workarounds
- Require administrators to clear the stored bind password before changing the LDAP server address, then re-enter it only after verifying the new destination.
- Use a dedicated bind account with least-privilege read access to the directory to limit impact if the credential is exposed.
- Place Mattermost behind egress filtering that only permits LDAP/LDAPS connections to approved directory servers.
# Example egress allow-list concept (iptables)
# Permit LDAPS only to the sanctioned domain controller
iptables -A OUTPUT -p tcp -d 10.0.10.25 --dport 636 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 389 -j DROP
iptables -A OUTPUT -p tcp --dport 636 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
