Mattermost
Mattermost Updates Fix Agents Plugin Replacement Flaw
10/28/2026
Mattermost updates fix an Agents plugin path traversal leading to plugin replacement and code execution. Update, validate, and retain evidence.
Mattermost Updates Fix OAuth SSRF and Plugin Route Denial of Service
09/22/2026
Mattermost updates address administrator-controlled OAuth SSRF and authenticated plugin-request memory exhaustion. Match the fix to each server's release branch, update the cluster, and validate sign-in and plugin workflows; neither flaw is described as unauthenticated.
Mattermost Updates Bound Bulk Reactions Requests
09/22/2026
An authenticated Mattermost user can submit an unbounded bulk-reactions post-ID array and overload the database. Update the installed maintenance stream, prepare database recovery, and verify every application node leaves the affected range.