CVE-2026-2476 — MS Teams plugin sensitive config values not properly masked in support packets

CVE-2026-2476

MS Teams plugin sensitive config values not properly masked in support packets PUBLISHED

Description (CNA)

Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 0 through 2.0.3; unaffected 2.3.1.0

CWE

CWE-200

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.