LowVulnerabilityLLM-specific
CVE-2025-31363: Mattermost AI plugin unrestricted LLM domain requests enabling data exfiltration
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-31363
- Published
- Record updated
- Affected
- github.com/mattermost/mattermost/server/v8 >= 10.5.0, < 10.5.1, fixed in 10.5.1
- github.com/mattermost/mattermost/server/v8 >= 10.4.0, < 10.4.3, fixed in 10.4.3
- github.com/mattermost/mattermost/server/v8 >= 9.11.0, < 9.11.10, fixed in 9.11.10
- and 1 more
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
Mattermost versions 10.4.x up to and including 10.4.2, 10.5.x up to and including 10.5.0, and 9.11.x up to and including 9.11.9 fail to restrict which domains the LLM can request to contact upstream. An authenticated user can perform a prompt injection through the AI plugin's Jira tool to exfiltrate data from any server reachable by the victim.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
- MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
- MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSimilar attack · BleepingComputer
- MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research