CVE-2026-4915: Mattermost Webhook DoS Vulnerability

CVE-2026-4915 Overview

CVE-2026-4915 is a denial of service vulnerability affecting multiple Mattermost server versions. The flaw exists in the outgoing webhook attachment processing logic, which fails to filter nil elements from webhook callback response payloads. An authenticated user can send a crafted webhook callback response containing a null attachment entry, causing the server process to terminate. The issue is tracked under Mattermost Advisory ID MMSA-2026-00641 and maps to CWE-754 (Improper Check for Unusual or Exceptional Conditions).

Critical Impact

An authenticated attacker can terminate the Mattermost server process by returning a webhook payload containing a null attachment, disrupting collaboration services for all users.

Affected Products

• Mattermost Server 11.6.x versions <= 11.6.0
• Mattermost Server 11.5.x versions <= 11.5.3 and 11.4.x versions <= 11.4.4
• Mattermost Server 10.11.x versions <= 10.11.14

Discovery Timeline

• 2026-05-25 - CVE-2026-4915 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-4915

Vulnerability Analysis

The vulnerability resides in the Mattermost outgoing webhook handler. When a registered outgoing webhook fires, Mattermost sends an HTTP request to the configured callback URL and processes the JSON response. The response can contain an attachments array describing message attachments to post back into the channel.

The server iterates over the returned attachment slice without validating that each element is non-nil. A response containing a null entry in the attachments array introduces a nil pointer into the slice. Subsequent dereferencing of that nil attachment triggers a runtime panic that the worker does not recover from, causing the server process to terminate.

Exploitation requires an authenticated account with permission to create or trigger an outgoing webhook. No special privileges beyond standard user webhook creation rights are required, and the attack can be repeated to keep the service offline.

Root Cause

The root cause is improper handling of an exceptional condition [CWE-754]. The webhook response parser deserializes attacker-controlled JSON into a slice of attachment pointers but does not filter or guard against nil entries before processing. Go's automatic panic on nil dereference is not caught by a recovery handler in this code path.

Attack Vector

An authenticated user creates an outgoing webhook pointing to a callback URL under their control. When the webhook fires, the attacker-controlled endpoint returns a JSON body where the attachments field contains an explicit null element. Parsing and processing of this payload causes the Mattermost server process to crash.

No verified public proof-of-concept code is available. Refer to the Mattermost Security Updates advisory for additional technical details.

Detection Methods for CVE-2026-4915

Indicators of Compromise

• Unexpected Mattermost server process terminations or restarts correlated with outgoing webhook execution
• Panic stack traces in Mattermost logs referencing webhook attachment processing or nil pointer dereference
• Outgoing webhook callback URLs pointing to untrusted or recently created external endpoints

Detection Strategies

• Monitor Mattermost application logs for runtime error: invalid memory address or nil pointer dereference panics tied to webhook handlers
• Alert on repeated mattermost service restarts within short time windows, particularly following webhook activity
• Audit the OutgoingWebhooks table for webhooks created by non-administrative users with external callback URLs

Monitoring Recommendations

• Enable process supervision metrics and alert on abnormal restart counts of the Mattermost server
• Forward Mattermost server logs to a centralized log platform and create rules for panic signatures in webhook code paths
• Correlate authentication events with webhook creation and execution to identify abuse patterns

How to Mitigate CVE-2026-4915

Immediate Actions Required

• Upgrade Mattermost to a fixed release in the 11.6, 11.5, 11.4, or 10.11 branches as published by the vendor
• Restrict outgoing webhook creation to trusted administrators by adjusting role permissions
• Review existing outgoing webhooks and remove any pointing to untrusted callback URLs

Patch Information

Mattermost has released fixed versions addressing CVE-2026-4915 under advisory MMSA-2026-00641. Administrators should consult the Mattermost Security Updates page for the exact patched version numbers in each supported branch and apply the corresponding upgrade.

Workarounds

• Disable outgoing webhooks system-wide by setting ServiceSettings.EnableOutgoingWebhooks to false until patching is complete
• Limit the manage_outgoing_webhooks permission to administrative roles only
• Place Mattermost behind a process supervisor configured to restart the service automatically to reduce downtime if exploitation occurs

# Configuration example: disable outgoing webhooks in config.json
# Set the following key under ServiceSettings, then restart Mattermost
#   "EnableOutgoingWebhooks": false

jq '.ServiceSettings.EnableOutgoingWebhooks = false' \
  /opt/mattermost/config/config.json > /tmp/config.json \
  && mv /tmp/config.json /opt/mattermost/config/config.json \
  && systemctl restart mattermost