CVE-2026-6517 — Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed

CVE-2026-6517

Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed PUBLISHED

Description (CNA)

Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that routes to an external web server. Mattermost Advisory ID: MMSA-2026-00651

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 0 through 5.5.13; unaffected 6.2.0; unaffected 5.13.6.0

CWE

CWE-522

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.