CVE-2026-9699: OpenAI API key leaks into logs on

Q: Is CVE-2026-9699 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-9699, increasing the risk of exploitation.

Q: What systems are affected by CVE-2026-9699?

This vulnerability affects the following AI/ML architecture patterns: LLM API integrations, third-party chat/collaboration plugin integrations.

Q: What is the CVSS score for CVE-2026-9699?

CVE-2026-9699 has a CVSS v3.1 base score of 6.8 (MEDIUM). The EPSS exploitation probability is 0.33%.

CISO Take

A Mattermost plugin logs raw OpenAI API error responses without sanitization, so when authentication to OpenAI fails the API key ends up readable in mattermost.log and in support packets generated for troubleshooting. This isn't remotely exploitable by an outsider — it requires high privileges, specifically access to server logs or a support bundle — but that access is routinely granted to sysadmins, MSPs, and even to Mattermost support staff during incident triage, making the actual exposure surface wider than the CVSS vector suggests. EPSS sits at just 0.00325 (top 76th percentile, still low absolute probability) and CISA's SSVC decision is TRACK, with no public exploit or Nuclei template, so this is not an active-exploitation emergency. The real risk is a leaked OpenAI key sitting in a log file or a support ticket attachment indefinitely, from which an attacker could rack up API usage or pivot into whatever data the key's OpenAI account can reach. Action: upgrade to the patched plugin versions per MMSA-2026-00609 (11.6.5.0, 11.6.5.x line, 11.3.6, 10.18.11, or later), then grep historical mattermost.log files and any archived support packets for OpenAI key patterns (sk-...) and rotate any exposed keys immediately.

Sources: NVD EPSS CISA KEV ATLAS

What is the risk?

CVSS 6.8 (Medium) reflects a high-confidentiality-impact, no-integrity/availability information disclosure bug gated by a high privilege requirement (PR:H) — the attacker must already have access to server logs or support packets, which typically means an admin, MSP, or vendor-support role rather than an anonymous outsider. There is no known public exploit, no scanner template, and EPSS is very low (0.00325), so opportunistic mass exploitation is unlikely. However, the scope is changed (S:C) because the leaked artifact is a third-party credential (OpenAI API key) that extends impact beyond the Mattermost server itself into the victim's OpenAI account and billing. The main residual risk is retrospective: any log or support bundle generated before patching may already contain a recoverable key that needs rotation regardless of whether the plugin is updated.

How does the attack unfold?

Privileged access

Attacker obtains legitimate or abused access to Mattermost server logs or a support packet (admin, MSP, or vendor support role).

Log inspection

Attacker searches mattermost.log entries generated during OpenAI authentication failures for credential material.

AML.T0037

Credential recovery

Attacker extracts a valid or partially reconstructable OpenAI API key from the unsanitized error response.

AML.T0055

Credential reuse / impact

Attacker uses the recovered key against the OpenAI API, incurring usage costs or accessing data/functionality tied to that key's account.

AML.T0012

Privileged access

Attacker obtains legitimate or abused access to Mattermost server logs or a support packet (admin, MSP, or vendor support role).

Log inspection

Attacker searches mattermost.log entries generated during OpenAI authentication failures for credential material.

AML.T0037

Credential recovery

Attacker extracts a valid or partially reconstructable OpenAI API key from the unsanitized error response.

AML.T0055

Credential reuse / impact

Attacker uses the recovered key against the OpenAI API, incurring usage costs or accessing data/functionality tied to that key's account.

AML.T0012

How severe is it?

CVSS 3.1

6.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR High

UI None

S Changed

C High

I None

A None

What should I do?

1 step

1) Upgrade the affected Mattermost plugin to the fixed release per MMSA-2026-00609 (versions after <=11.6, 10.18.11, 11.3.6, 11.6.5.0). 2) Audit existing mattermost.log files, log aggregation/SIEM exports, and any support packets shared with Mattermost or third parties for OpenAI key strings (prefix sk-) or partial key fragments in auth-failure entries. 3) Rotate any OpenAI API key that may have been logged, regardless of whether exploitation is confirmed. 4) Restrict access to server logs and support-packet generation to least-privilege admin roles, and ensure log exports are handled through secure, access-controlled channels. 5) As a general hardening step, configure log redaction/scrubbing for any integration that proxies third-party API credentials, since this class of bug (CWE-532) recurs across plugin ecosystems.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Plugin API AML.T0012 - Valid Accounts AML.T0037 - Data from Local System AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system data security

NIST AI RMF

GOVERN 1.5 / MANAGE 4.1 - Risk monitoring and credential/data protection for AI system components

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-9699?

A Mattermost plugin logs raw OpenAI API error responses without sanitization, so when authentication to OpenAI fails the API key ends up readable in mattermost.log and in support packets generated for troubleshooting. This isn't remotely exploitable by an outsider — it requires high privileges, specifically access to server logs or a support bundle — but that access is routinely granted to sysadmins, MSPs, and even to Mattermost support staff during incident triage, making the actual exposure surface wider than the CVSS vector suggests. EPSS sits at just 0.00325 (top 76th percentile, still low absolute probability) and CISA's SSVC decision is TRACK, with no public exploit or Nuclei template, so this is not an active-exploitation emergency. The real risk is a leaked OpenAI key sitting in a log file or a support ticket attachment indefinitely, from which an attacker could rack up API usage or pivot into whatever data the key's OpenAI account can reach. Action: upgrade to the patched plugin versions per MMSA-2026-00609 (11.6.5.0, 11.6.5.x line, 11.3.6, 10.18.11, or later), then grep historical mattermost.log files and any archived support packets for OpenAI key patterns (sk-...) and rotate any exposed keys immediately.

Is CVE-2026-9699 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-9699, increasing the risk of exploitation.

How to fix CVE-2026-9699?

1) Upgrade the affected Mattermost plugin to the fixed release per MMSA-2026-00609 (versions after <=11.6, 10.18.11, 11.3.6, 11.6.5.0). 2) Audit existing mattermost.log files, log aggregation/SIEM exports, and any support packets shared with Mattermost or third parties for OpenAI key strings (prefix sk-) or partial key fragments in auth-failure entries. 3) Rotate any OpenAI API key that may have been logged, regardless of whether exploitation is confirmed. 4) Restrict access to server logs and support-packet generation to least-privilege admin roles, and ensure log exports are handled through secure, access-controlled channels. 5) As a general hardening step, configure log redaction/scrubbing for any integration that proxies third-party API credentials, since this class of bug (CWE-532) recurs across plugin ecosystems.

What systems are affected by CVE-2026-9699?

This vulnerability affects the following AI/ML architecture patterns: LLM API integrations, third-party chat/collaboration plugin integrations.

What is the CVSS score for CVE-2026-9699?

CVE-2026-9699 has a CVSS v3.1 base score of 6.8 (MEDIUM). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

LLM API integrationsthird-party chat/collaboration plugin integrations

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0037 Data from Local System

AML.T0055 Unsecured Credentials

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN 1.5 / MANAGE 4.1

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with access to server logs or support packets to obtain a valid or partially reconstructable OpenAI API key via inspection of mattermost.log entries generated during authentication failures. Mattermost Advisory ID: MMSA-2026-00609

Exploitation Scenario

An internal admin, an MSP with delegated server access, or a Mattermost support engineer handling a routine troubleshooting request receives or accesses a support packet or raw log export from an affected server. Inside mattermost.log they find one or more authentication-failure entries generated when the OpenAI plugin's key was briefly invalid (e.g., during a key rotation window or a billing lapse) — the entry contains the full or partially reconstructable OpenAI API key in plaintext. The recipient extracts the key and uses it directly against the OpenAI API, incurring usage on the victim organization's account, exfiltrating any data reachable via that key's scope, or reselling access. No exploit tooling or AI/ML expertise is required — this is a manual log-inspection and credential-reuse attack enabled purely by insufficient log sanitization.

Weaknesses (CWE)

CWE-532 Insertion of Sensitive Information into Log File CWE-532 Insertion of Sensitive Information into Log File

CWE-532 — Insertion of Sensitive Information into Log File: The product writes sensitive information to a log file.

[Architecture and Design, Implementation] Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
[Distribution] Remove debug log files before deploying the application into production.

Source: MITRE CWE corpus.