Mattermost Calls Plugin Exposes TURN Server Credentials via CVE-2026-6347

The National Vulnerability Database has detailed CVE-2026-6347, a high-severity vulnerability (CVSS 7.6) affecting Mattermost versions 11.5.x up to 11.5.1, 10.11.x up to 10.11.13, and 11.4.x up to 11.4.3. This flaw resides in the Mattermost Calls plugin, which fails to properly sanitize sensitive configuration fields.

According to the National Vulnerability Database, an attacker with access to a support packet can exploit this weakness. They can obtain plaintext TURN server credentials directly from the exported plugin configuration. This isn’t some theoretical bypass; it’s a direct exposure of critical authentication data, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

This vulnerability highlights a fundamental issue: treating configuration exports as benign. Attackers are constantly looking for low-friction ways to escalate privileges or pivot. Access to TURN server credentials can facilitate man-in-the-middle attacks, eavesdropping, or denial-of-service against voice and video communications, undermining the very trust Mattermost aims to build for team collaboration.