CVE-2026-13411 — Null condition in Playbooks import crashes the plugin

CVE-2026-13411

Null condition in Playbooks import crashes the plugin PUBLISHED

Description (CNA)

Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks plugin instance-wide via a crafted import request containing a null condition. Mattermost Advisory ID: MMSA-2026-00709

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 11.7.0 through 11.7.11; unaffected 11.10.0; unaffected 11.7.12

CWE

CWE-754

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.