Rocket.Chat vulnerabilities and fixes

CVEs that mention Rocket.Chat, ranked by priority. 9 tracked.

Rocket.Chat has 9 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 7. Most recent: 2026-08-10. Highest priority: CVE-2026-29198 (score 54/100).

• CVE-2026-29198 CRITICAL 9.8 UPGRADE In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulne
• CVE-2023-23917 HIGH 8.8 UPGRADE A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE
• CVE-2026-48616 CRITICAL 9.3 UPGRADE Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerab
• CVE-2026-48929 HIGH 7.5 UPGRADE Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to
• CVE-2026-32995 HIGH 7.5 The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5,
• CVE-2023-28325 MEDIUM 6.5 UPGRADE An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the
• CVE-2026-72918 MEDIUM 5.4 Rocket.Chat is an open-source, secure, fully customizable communications platform
• CVE-2026-29197 MEDIUM 4.3 UPGRADE In versions <8.4.0, <8.3.2, <8.2.2, <8.1.3, <8.0.4, <7.13.6, <7.12.7, <7.11.7, and <7.10.10, the endpoints /ap
• CVE-2026-72919 MEDIUM 4.3 Rocket.Chat is an open-source, secure, fully customizable communications platform

FAQ

How do I fix Rocket.Chat vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Rocket.Chat being exploited right now?

None of the tracked Rocket.Chat CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Rocket.Chat CVE should I patch first?

CVE-2026-29198 currently ranks highest (54/100): In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulne.

← Back to latest CVEs