Mattermost versions 10.11.x through 10.11.18, 11.6.x through 11.6.3, and 11.5.x through 11.5.6 allow attachment URLs provided by users to bypass internal IP address filtering. The lack of validation enables an attacker with access to the MCP server in stdio mode to request arbitrary internal URLs from the server, potentially exfiltrating sensitive information. This flaw falls under CWE‑918, representing a server‑side request forgery weakness that can compromise confidentiality and possibly integrity of internal services.

The affected vendor is Mattermost, specifically the Mattermost Mattermost product. The vulnerability applies to the listed versions: all 10.11.x releases up to 10.11.18, all 11.6.x releases up to 11.6.3, and all 11.5.x releases up to 11.5.6.

The CVSS score of 6.5 indicates a moderate severity. EPSS is not available, so the probability of exploitation is currently unknown. The vulnerability is not listed in CISA KEV. The attack requires the attacker to have access to the MCP server in stdio mode, so the vector is likely internal but could be leveraged by compromised internal users or services with such access.