VULNERABILITY INTELLIGENCE
CVE-2026-9699
CVSS score6.8 MEDIUM
EPSS probability0.46%
CISA KEVNot currently listed
Published2026-06-26
Last modified2026-06-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Description
Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with access to server logs or support packets to obtain a valid or partially reconstructable OpenAI API key via inspection of mattermost.log entries generated during authentication failures. Mattermost Advisory ID: MMSA-2026-00609
Weakness classification
- CWE-532: Insertion of Sensitive Information into Log File