Threats affecting pkg:npm/mattermost/plugins

Mattermost Plugins versions 10.18.11, 11.3.6, 11.6.5.0, and all versions up to 11.6 fail to sanitize error responses from the OpenAI API before logging. This vulnerability allows users with access to server logs or support packets to obtain a valid or partially reconstructable OpenAI API key by inspecting mattermost.log entries generated during authentication failures. The issue is tracked as CVE-2026-9699 and is classified under CWE-532 (Information Exposure Through Log Files).