Mattermost plugins prior to the specified versions do not remove OpenAI API keys from error responses before logging. When an authentication failure occurs, the API key or a usable portion of it is written to mattermost.log. An attacker who can read these logs, either directly on the server or through support packet reviews, can OpenAI API key, enabling unauthorized use of the OpenAI service and potential financial or data exposure consequences. The weakness is classified as CWE-532, unsanitized logging of sensitive data.

The vulnerable software is Mattermost Plugins. Versions identical or lower than 11.6, 10.18.11, 11.3.6, or 11.6.5.0. The vendor is Mattermost and the product is the Mattermost plugin set.

The CVSS score of 6.8 indicates a medium severity vulnerability. Exploit probability information is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires access to the server’s log files or to support packets, meaning either local or privileged compromise of the host. Once the attacker obtains the key, they can authenticate to OpenAI services without authorization, potentially incurring costs or exposing sensitive data. Protecting log files and ensuring vendors have patched the issue reduces this risk.