Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, and 11.5.x <= 11.5.6 fail to enforce markdown image rendering restrictions on AI bot tool result posts. This allows an authenticated attacker to inject markdown image syntax into the tool result content. When a victim's client renders this content, it can cause data exfiltration to an attacker-controlled server. The vulnerability is identified as CVE-2026-3472 and is associated with CWE-693 (Protection Mechanism Failure). The CVSS 3.1 vector indicates network attack vector, low complexity, requiring privileges and user interaction, with low confidentiality impact and no integrity or availability impact.

An authenticated attacker can exfiltrate data from a victim's client by injecting specially crafted markdown image syntax into AI bot tool result posts. The impact is limited to confidentiality with no direct effect on integrity or availability. The vulnerability requires the attacker to have some privileges and the victim to interact with the malicious content.

Patch status is not yet confirmed — check the vendor advisory (Mattermost Advisory ID: MMSA-2026-00619) for current remediation guidance. Until an official fix is available, restrict or monitor the use of AI bot tool result posts and limit privileges to reduce the risk of exploitation.