Unbegrenzte Anfragekörper-Leseoperation in MS Teams Plugin {{/lifecycle}} Webhook-Endpunkt

The primary impact of CVE-2026-21388 is a denial-of-service condition within a Mattermost instance. An attacker can trigger this by sending a large JSON payload to the {{/lifecycle}} webhook endpoint, overwhelming the server's memory resources. This can lead to service instability, slow response times, and potentially a complete shutdown of the Mattermost application. While the CVSS score is low, the impact can still be disruptive, particularly in environments where Mattermost is critical for communication and collaboration. The blast radius is limited to the affected Mattermost instance.

Organizations utilizing Mattermost Plugins, particularly those with custom integrations or plugins that heavily rely on webhooks, are at risk. Environments with weak authentication controls or compromised user accounts are more vulnerable, as successful exploitation requires authentication. Shared hosting environments where multiple users share the same Mattermost instance could also be affected.

• linux / server: Monitor Mattermost plugin process memory usage using top or htop. Look for unusually high memory consumption.

top -u mattermost

• generic web: Examine Mattermost access logs for unusually large POST requests to the {{/lifecycle}} endpoint.

grep '{{/lifecycle}}' /var/log/nginx/access.log | awk '{print $7}' | sort -n | tail -1

• go: Review Mattermost plugin code for proper request body size validation on the {{/lifecycle}} endpoint. Look for missing or inadequate size checks.

1. 2026-04-09Disclosure

   disclosure

1. Reserviert2026-02-11
2. Veröffentlicht2026-04-09
3. EPSS aktualisiert2026-04-16

The recommended mitigation for CVE-2026-21388 is to upgrade Mattermost Plugins to version 2.3.2.0 or later. If an immediate upgrade is not feasible, implement a Web Application Firewall (WAF) or proxy to limit the size of incoming requests to the {{/lifecycle}} webhook endpoint. Configure the WAF/proxy to reject requests exceeding a reasonable size threshold (e.g., 1MB). Monitor Mattermost server resource utilization (CPU, memory) for signs of exhaustion. After upgrading, verify the fix by attempting to send an oversized JSON payload to the webhook endpoint; the request should be rejected by the server.