CVE-2026-2455: Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation

March 16, 2026 (updated March 18, 2026)

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation which allows an attacker to perform SSRF attacks against internal services via IPv4-mapped IPv6 literals (e.g., [::ffff:127.0.0.1]).. Mattermost Advisory ID: MMSA-2026-00585

References

github.com/advisories/GHSA-gqv7-j2j8-qmwq
github.com/mattermost/mattermost
github.com/mattermost/mattermost/commit/5d787969c2d5ab591a9dcd61b0810475eed7a646
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-2455

Code Behaviors & Features

Detect and mitigate CVE-2026-2455 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →