CVE-2026-75587: Mattermost Desktop Information Disclosure

CVE-2026-75587 Overview

CVE-2026-75587 is an information disclosure vulnerability in Mattermost Desktop App versions <=6.2.2.0. The application fails to redact the pre-auth secret when generating a diagnostics report. A local attacker with access to a user's diagnostics report or log files can obtain the plaintext pre-auth secret configured for a connected server. The secret is exposed through the Server Connectivity (Step-3) diagnostics output. Mattermost tracks this issue as advisory MMSA-2026-00716. The vulnerability is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Local attackers who obtain diagnostics reports or log files can extract the plaintext pre-auth secret used to authenticate the desktop client to a connected Mattermost server.

Affected Products

Mattermost Desktop App versions <=6.2.2.0
Mattermost Desktop client generating diagnostics reports
Endpoints storing Mattermost diagnostics logs locally

Discovery Timeline

2026-08-17 - CVE-2026-75587 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75587

Vulnerability Analysis

The Mattermost Desktop App includes a diagnostics feature that captures runtime state and server connectivity information for troubleshooting. During the Server Connectivity (Step-3) phase, the diagnostics routine writes configuration values, including the pre-auth secret, to the report output. The application does not apply redaction or masking to sensitive credential material before serializing this data. Any user or process with read access to the resulting diagnostics report or log file can recover the pre-auth secret in plaintext. Attackers who obtain this secret can authenticate to the connected Mattermost server as the affected client.

Root Cause

The root cause is missing output sanitization in the diagnostics report generator. The Server Connectivity (Step-3) writer emits configuration fields verbatim rather than masking secret values. This design assumes diagnostics files remain private, which is not enforced by file permissions or by the application.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker reads the diagnostics report or associated log files from the user's filesystem. Typical acquisition paths include shared support tickets, backup archives, cloud sync folders, and compromised endpoints. Once the attacker parses the Step-3 output, the pre-auth secret is directly readable.

No public proof-of-concept code is available for this vulnerability. Refer to the Mattermost Security Updates advisory for vendor technical details.

Detection Methods for CVE-2026-75587

Indicators of Compromise

Diagnostics report files or log files from Mattermost Desktop containing readable pre-auth secret strings in the Server Connectivity (Step-3) section.
Unauthorized reads or copies of Mattermost diagnostics output from user profile directories.
Unexpected authentication events against Mattermost servers using pre-auth secrets from clients that have not initiated a session.

Detection Strategies

Scan endpoint filesystems for Mattermost diagnostics artifacts and inspect Step-3 output for unredacted secret fields.
Correlate file access telemetry on diagnostics paths with processes outside the Mattermost Desktop binary.
Alert on diagnostics files leaving the host through email, chat uploads, or cloud sync clients.

Monitoring Recommendations

Monitor support ticket attachments and shared troubleshooting bundles for Mattermost diagnostics content.
Track authentication activity on Mattermost servers for reuse of pre-auth secrets from unexpected sources.
Log and review access to user profile directories where Mattermost Desktop writes diagnostics and log output.

How to Mitigate CVE-2026-75587

Immediate Actions Required

Upgrade Mattermost Desktop App to a version above 6.2.2.0 once the vendor patch is available.
Rotate the pre-auth secret on any Mattermost server whose configuration was captured in a diagnostics report from an affected client.
Delete existing diagnostics reports and log files generated by vulnerable desktop versions.
Restrict filesystem permissions on Mattermost user data directories to the owning user only.

Patch Information

Mattermost has published advisory MMSA-2026-00716. Review the Mattermost Security Updates page for the fixed release and upgrade instructions.

Workarounds

Do not generate or share Mattermost Desktop diagnostics reports until the patched version is deployed.
If diagnostics output is required for support, manually redact the Server Connectivity (Step-3) section before transmission.
Store any existing diagnostics files on encrypted volumes and remove them from backup and cloud sync scopes.

bash

# Configuration example
# Remove existing Mattermost Desktop diagnostics and logs on Linux/macOS
rm -f ~/.config/Mattermost/logs/*.log
rm -f ~/.config/Mattermost/diagnostics-*.txt

# Restrict permissions on the Mattermost user data directory
chmod 700 ~/.config/Mattermost