Back to search

RocketChat

Rocket.Chat

Open-source team chat and collaboration platform.

8.9 Current train 8.8 Switch to this train 8.7 Switch to this train 8.6 Switch to this train 8.5 Switch to this train 8.4 Switch to this train 8.3 Switch to this train 8.2 Switch to this train 8.1 Switch to this train 8.0 Switch to this train 7.13 Switch to this train 7.12 Switch to this train 7.11 Switch to this train 7.10 Switch to this train
Current version
Last checked: 2026-10-20

8.9.0

Release date
October 05, 2026
Security status
Current version appears affected by 1 high-severity CVE.

Source

GitHub API

Public release notes are linked for the latest stored release.

View release notes Subscribe to updates

Release history

See the latest published releases stored for this product.

Version Published Notes
8.9.0 2026-10-05 Release Notes

Vulnerability tracking

versionPing monitors CVEs for this product. Matching CVEs are listed below. We only display CVEs with a CVSS score of 7.0 or higher that were published within the last 90 days.

Affected status is inferred from published affected version ranges where available. Always verify against the vendor advisory before making production decisions.

CVE Severity Published Status Summary
CVE-2026-65644 HIGH (7.5) 2026-08-21 Current versionnot affected

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via dangerouslySetInnerHTML in the Omnichannel Queue side panel (InquireSidePanelItem.tsx), injecting a real, clickable HTML link - pointing to any attacker-controlled domain, with arbitrary social-engineering text - into the DOM of any agent viewing the queue.

Affected versions
  • From (including) 0 - Up to (excluding) 8.8.0
  • From (including) 0 - Up to (excluding) 8.7.1
Show 7 more
  • From (including) 0 - Up to (excluding) 8.6.2
  • From (including) 0 - Up to (excluding) 8.5.3
  • From (including) 0 - Up to (excluding) 8.4.6
  • From (including) 0 - Up to (excluding) 8.3.8
  • From (including) 0 - Up to (excluding) 8.2.8
  • From (including) 0 - Up to (excluding) 8.1.8
  • From (including) 0 - Up to (excluding) 7.10.15
CVE-2026-56845 HIGH (7.5) 2026-08-04 Current versionnot affected

An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.

Affected versions
  • From (including) 0 - Up to (excluding) 8.2.0
  • From (including) 0 - Up to (excluding) 8.1.1
Show 5 more
  • From (including) 0 - Up to (excluding) 8.0.2
  • From (including) 0 - Up to (excluding) 7.13.4
  • From (including) 0 - Up to (excluding) 7.12.5
  • From (including) 0 - Up to (excluding) 7.11.5
  • From (including) 0 - Up to (excluding) 7.10.8
CVE-2026-58066 CRITICAL (9.8) 2026-07-30 Current versionnot affected

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.

Affected versions
  • From (including) 0 - Up to (excluding) 8.7.0
  • From (including) 0 - Up to (excluding) 8.6.1
Show 7 more
  • From (including) 0 - Up to (excluding) 8.5.2
  • From (including) 0 - Up to (excluding) 8.4.5
  • From (including) 0 - Up to (excluding) 8.3.7
  • From (including) 0 - Up to (excluding) 8.2.7
  • From (including) 0 - Up to (excluding) 8.1.7
  • From (including) 0 - Up to (excluding) 8.0.8
  • From (including) 0 - Up to (excluding) 7.10.14
CVE-2026-29198 CRITICAL (9.8) 2026-04-22 Current versionaffected

In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to account takeover of the first user with a generated token when an OAuth app is configured.

Affected versions
  • All versions