CVE-2025-35965
📋 TL;DR
This vulnerability allows attackers to create task items with excessive actions via the UpdateRunTaskActions GraphQL operation, causing server overload and denial-of-service. It affects Mattermost instances running vulnerable versions 9.11.x through 10.5.0. Both authenticated and unauthenticated users could potentially exploit this depending on configuration.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion, potentially affecting all users and disrupting business operations.
Likely Case
Performance degradation and intermittent service disruptions affecting user experience and productivity.
If Mitigated
Minimal impact with proper rate limiting, monitoring, and updated versions.
🎯 Exploit Status
Exploitation requires knowledge of GraphQL endpoints but is technically simple. Unauthenticated access depends on Mattermost configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.11.11, 10.4.3, 10.5.1 or later
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup your Mattermost instance. 2. Upgrade to patched version (9.11.11+, 10.4.3+, or 10.5.1+). 3. Restart Mattermost service. 4. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Rate Limit GraphQL Operations
allImplement rate limiting on GraphQL endpoints to prevent excessive requests
Configure rate limiting in Mattermost config.json or via reverse proxy
Restrict GraphQL Access
allLimit access to GraphQL endpoints to authenticated users only
Update Mattermost configuration to require authentication for API endpoints
🧯 If You Can't Patch
- Implement strict rate limiting on all GraphQL endpoints
- Monitor server resource usage and set alerts for abnormal spikes
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About or run: mattermost versionCheck Version:
mattermost versionVerify Fix Applied:
Verify version is 9.11.11+, 10.4.3+, or 10.5.1+ and test UpdateRunTaskActions with excessive actions📡 Detection & Monitoring
Log Indicators:
- Multiple UpdateRunTaskActions operations in short time
- High CPU/memory usage spikes
- GraphQL query errors related to task actions
Network Indicators:
- Unusual GraphQL request patterns
- Multiple POST requests to /api/v4/graphql
SIEM Query:
source="mattermost" AND ("UpdateRunTaskActions" OR "graphql" AND "task") | stats count by src_ip