Mattermost servers running certain early 11.x releases expose the plaintext AD/LDAP bind password when an administrator edits other connection settings and then uses the Test Connection diagnostics feature. The flaw occurs because the software fails to clear or re‑hash the stored bind password after a configuration change, allowing the password to be sent in cleartext to a server defined by the administrator. This enables an attacker with control over the target server to capture the bind credentials used for directory authentication.

Affected versions include Mattermost 11.9.x up to and including 11.9.1, 11.8.x up to 11.8.5, 11.7.x up to 11.7.10, and 11.10.x up to 11.10.1. All installations of Mattermost using these releases are vulnerable and should be updated to the latest patch level for each branch (11.11.0, 11.9.2, 11.8.6, 11.7.11, 11.10.2 or newer).

The CVSS score of 4.9 places this vulnerability in the moderate severity range. EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and the flaw is not listed in the CISA KEV catalog. The attack vector is likely remote, requiring an authenticated System Console administrator to trigger the Test Connection to a malicious server. Once triggered, the plaintext bind password is transmitted over the network, potentially allowing credential theft and subsequent lateral movement within the infrastructure.