CVE-2026-96260: Mattermost CSRF Validation DoS Vulnerability

CVE-2026-96260 Overview

CVE-2026-96260 is a denial of service vulnerability in Mattermost affecting the plugin request handling logic. The application fails to enforce a request body size limit during Cross-Site Request Forgery (CSRF) validation of plugin requests. An authenticated user can send a large request body to a plugin endpoint, exhausting server memory and rendering the service unavailable. The issue is tracked under Mattermost Advisory ID MMSA-2026-00775 and is classified as [CWE-789] Memory Allocation with Excessive Size Value.

Critical Impact
Authenticated users can exhaust server memory and cause service-wide denial of service by submitting an oversized request body to any plugin endpoint.

Affected Products

Mattermost 11.9.x versions 11.9.0 through 11.9.1
Mattermost 11.8.x versions 11.8.0 through 11.8.5
Mattermost 11.7.x versions 11.7.0 through 11.7.10
Mattermost 11.10.x versions 11.10.0 through 11.10.1

Discovery Timeline

2026-09-22 - CVE-2026-96260 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96260

Vulnerability Analysis

Mattermost supports server-side plugins that expose HTTP endpoints under the plugin request namespace. Before a plugin handler receives a request, the server performs CSRF validation on the incoming request. During this validation step, the server reads the request body without applying a maximum size limit.

A valid authenticated session is required to reach the plugin endpoint. Once authenticated, the attacker can submit a request with an arbitrarily large body. The server buffers the body in memory during CSRF processing, driving memory usage until the process is terminated by the operating system or degrades service for other users.

The weakness maps to [CWE-789] Memory Allocation with Excessive Size Value. Because the limit check occurs after allocation, no application-level control prevents the resource consumption.

Root Cause

The root cause is missing enforcement of a maximum request body size at the CSRF validation stage of the plugin request pipeline. Plugin endpoints inherit an unbounded read path, allowing memory allocation proportional to attacker-controlled input.

Attack Vector

The vulnerability is exploitable over the network by any authenticated user account. No user interaction is required beyond the attacker sending a crafted HTTP request. The attacker issues a POST request to a plugin endpoint with a request body sized to consume available server memory. Repeated or concurrent requests amplify the resource exhaustion effect. Confidentiality and integrity are not impacted; availability is fully impacted, consistent with the CVSS vector for this issue.

No verified public code examples are available for this vulnerability. Refer to the Mattermost Security Updates advisory for further technical detail.

Detection Methods for CVE-2026-96260

Indicators of Compromise

HTTP requests to paths under /plugins/ with abnormally large Content-Length headers from authenticated sessions.
Mattermost server processes showing sudden memory growth followed by out-of-memory termination or unresponsiveness.
Repeated POST requests from a single authenticated user to the same plugin endpoint within a short time window.

Detection Strategies

Inspect reverse proxy or load balancer logs for requests to /plugins/* exceeding a defined body size threshold.
Correlate authenticated user session identifiers with server memory spikes and process restarts.
Alert on OOMKilled events or systemd service restarts affecting the Mattermost server process.

Monitoring Recommendations

Enable resource utilization metrics on Mattermost hosts and set thresholds for RSS memory growth rate.
Forward Mattermost application and proxy logs to a centralized log platform for correlation with process telemetry.
Track anomalous per-user request volumes and payload sizes to plugin endpoints.

How to Mitigate CVE-2026-96260

Immediate Actions Required

Upgrade Mattermost to a fixed release above the affected version ranges in the 11.7, 11.8, 11.9, and 11.10 branches.
Restrict plugin access to trusted user groups where feasible until patches are deployed.
Review authenticated user accounts and remove inactive or unnecessary accounts to reduce the attack surface.

Patch Information

Mattermost has released security updates addressing this issue. Refer to the Mattermost Security Updates portal and Advisory MMSA-2026-00775 for the specific fixed version corresponding to each affected release branch.

Workarounds

Configure the upstream reverse proxy (for example, NGINX or HAProxy) to enforce a maximum request body size on paths matching /plugins/*.
Disable non-essential server-side plugins until the server is upgraded.
Apply rate limiting on plugin endpoints per authenticated session to reduce impact from repeated large requests.

bash

# Example NGINX configuration to cap plugin request body size
location /plugins/ {
    client_max_body_size 1m;
    proxy_pass http://mattermost_backend;
}