{"vulnerability": "CVE-2026-19601", "sightings": [{"uuid": "3cabd3ca-87d1-4c8c-8c41-c1c10d424de2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19601", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117449538953496817", "content": "CVE-2026-19601 Disclosure of AD/LDAP bind password via Test Connection Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature. Mattermost Advisory ID: MMSA-2026-00764\nhttps://www.cve.org/CVERecord?id=CVE-2026-19601https://mattermost.com/security-updates#mattermost #Mattermost#CVE_2026_19601#bot", "creation_timestamp": "2026-10-16T08:02:20.982402Z"}]}