CVE-2026-75587: Plaintext pre-auth secret exposure via Desktop App diagnostics report

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-17 · updated 2026-08-19
Weakness: CWE-200

Description

Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the Server Connectivity (Step-3) diagnostics output. Mattermost Advisory ID: MMSA-2026-00716

Affected products

Mattermost Desktop: before 6.2.3 — fixed in 6.2.3

How to fix

Upgrade to a fixed version: Mattermost Desktop 6.2.3. Check the vendor advisory for mitigations.

References

https://mattermost.com/security-updates

Get alerted when CVE-2026-75587 or the next vulnerability affects your stack