Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-13411 EUVD-2026-108140GHSA-2273-qcv6-r2xj

Null condition in Playbooks import crashes the plugin

Published Oct 22, 2026 · Updated Oct 22, 2026 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost

Description

Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks plugin instance-wide via a crafted import request containing a null condition. Mattermost Advisory ID: MMSA-2026-00709

Affected products

VendorProductAffectedFixed
Mattermost Mattermost 11.7.0 – ≤ 11.7.11 11.10.0

References