github.com/mattermost/mattermost-plugin-calls

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

High 7.6

CVE-2026-6347

Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker with access to a support packet to obtain TURN server credentials via the plain…

Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-plugin-calls Go

May 18, 2026