CVE-2026-6342 — Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0

title: CVE-2026-6342 - Mattermost Plugin Namespace Manipulation
id: scw-2026-05-18-ai-1
status: experimental
level: medium
description: |
  This rule detects attempts to exploit CVE-2026-6342 by identifying web requests to Mattermost plugin APIs that include 'namespace=' in the query string. This pattern is indicative of an attacker attempting to manipulate namespaces within Mattermost plugins, potentially leading to unauthorized access or privilege escalation by creating groups that share prefixes with whitelisted groups.
author: SCW Feed Engine (AI-generated)
date: 2026-05-18
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6342/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/api/v4/plugins/'
      cs-uri-query|contains:
          - 'namespace=' 
      cs-method:
          - 'POST'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse