Mattermost Plugins up to version 11.6, including specific versions 10.18.11, 11.3.6, and 11.6.5.0, do not properly sanitize error responses from the OpenAI API before writing them to logs. As a result, sensitive information such as valid or partially reconstructable OpenAI API keys can be exposed to any user who has access to server logs or support packets. This vulnerability is identified as CVE-2026-9699 and categorized under CWE-532, indicating improper handling of sensitive data in logs. There is no vendor advisory or patch information provided in the input data.

An attacker or unauthorized user with access to Mattermost server logs or support packets can extract valid or partially reconstructable OpenAI API keys. This exposure can lead to unauthorized use of the OpenAI API under the compromised key, potentially resulting in abuse of API resources or data leakage. The vulnerability does not impact confidentiality, integrity, or availability of Mattermost itself directly but exposes sensitive credentials that could be misused externally.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to server logs and support packets to trusted personnel only to prevent unauthorized disclosure of OpenAI API keys. Monitor vendor channels for updates or patches addressing this issue.