Which versions of MongoDB Server are affected by CVE-2026-13067?

MongoDB Server installations using PROXY protocol v2 over Unix domain sockets are vulnerable to local privilege escalation, allowing attackers with valid X.509 certificates to bypass role-based…. A patch is available.

How to fix or mitigate CVE-2026-13067?

Immediate action (24 hours): Audit MongoDB deployments to identify instances with PROXY protocol v2 enabled over Unix domain sockets and document current certificate trust configurations; verify which local users and processes have access to affected socket endpoints. Within 7 days: Implement file system access restrictions on Unix domain socket directories to limit connectivity to trusted processes only, and disable PROXY protocol v2 if operationally feasible or enforce stricter certificate validation policies. Within 30 days: Conduct a comprehensive role-based access control (RBAC) audit across all affected MongoDB instances to verify proper role assignments, assess whether unauthorized escalations have occurred, implement X.509 authentication logging to detect anomalies, and establish monitoring to detect role assignment bypasses.

MongoDB Server CVE-2026-13067

Q: What is the CVSS score of CVE-2026-13067?

CVE-2026-13067 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-47794 HIGH

Incorrect Authorization (CWE-863)

2026-07-22 cna@mongodb.com

Authentication Bypass MongoDB

7.2

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.2 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Local socket access (AV:L) and a trusted-CA certificate plus non-default PROXY-v2 config make it high-complexity (AC:H) with low prior privileges (PR:L); high C/I from role escalation, no availability impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 21:03 EUVD

Analysis Generated

Jul 22, 2026 - 20:34 vuln.today

CVE Published

Jul 22, 2026 - 20:16 cve.org

HIGH 7.2

DescriptionCVE.org

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.

AnalysisAI

Improper authorization in MongoDB Server allows a local attacker holding a valid trusted-CA X.509 certificate to obtain unintended database roles when PROXY protocol v2 is used over the Unix domain socket, because certificate-derived roles bypass the configured tlsCATrusts allow-list during MONGODB-X509 authentication. An attacker with local access to the proxy socket can therefore escalate to roles they were never granted, compromising confidentiality and integrity of data. Tracked via MongoDB SERVER-128387 and rated CVSS 4.0 7.2 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The flaw lives in MongoDB's handling of the PROXY protocol v2 header when clients connect over a Unix domain socket, a deployment pattern used to preserve original client identity behind load balancers or sidecar proxies. During MONGODB-X509 authentication, MongoDB maps the certificate's subject/extensions to internal roles, and the tlsCATrusts setting is meant to constrain which issuing CAs and role assertions are honored. This is a CWE-863 (Improper Authorization) defect: the authorization decision that should validate certificate-derived roles against the tlsCATrusts allow-list is skipped in the PROXY-v2-over-UDS code path, so role claims embedded in or derived from a trusted-CA-issued certificate are accepted without the intended policy check. The result is an authorization gap rather than an authentication bypass in the strict sense - the certificate is still validated as trusted, but the roles it confers are not properly scoped.

RemediationAI

No vendor-released patch version is identified in the available data, so the fixed release must be confirmed directly from MongoDB via SERVER-128387 (https://jira.mongodb.org/browse/SERVER-128387) and applied once published. As compensating controls until patched: disable PROXY protocol v2 on the Unix domain socket path if it is not strictly required, since this specific code path is what skips the tlsCATrusts validation; restrict filesystem access to the proxy Unix domain socket (tighten socket file permissions and the containing directory) so that only trusted local principals can connect, which directly raises the bar set by the AV:L/local-access requirement; and audit issued client certificates and the tlsCATrusts allow-list, revoking or tightly scoping any trusted-CA certificates that could assert privileged roles. Trade-offs: disabling PROXY protocol v2 will break preservation of original client source identity behind a load balancer, and tightening socket permissions may disrupt legitimate co-located proxy/sidecar processes, so validate connectivity for authorized clients after changes.