Which versions of MongoDB Ops Manager are affected by CVE-2026-8431?

MongoDB Ops Manager versions 7.0-8.0.22 contain a critical command injection vulnerability (CVSS 9.4) in webhook configuration exploitable by authenticated administrators.. A patch is available.

How to fix or mitigate CVE-2026-8431?

Within 24 hours: Audit all MongoDB Ops Manager deployments to identify current versions and enumerate users with webhook-configuration rights; document findings and coordinate with operations team for upgrade planning. Within 7 days: Test Ops Manager 8.0.23 in a non-production environment, validate compatibility with existing webhooks and integrations, and create a staged rollout plan; immediately restrict webhook-configuration privileges to the minimum necessary users pending completion of the upgrade. Within 30 days: Complete production deployment of Ops Manager 8.0.23 across all environments; verify that no instances of versions 7.0 or 8.0.22 remain active; and update administrative access controls to enforce least-privilege principles for webhook configuration.

MongoDB Ops Manager CVE-2026-8431

Q: What is the CVSS score of CVE-2026-8431?

CVE-2026-8431 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29749 CRITICAL

Command Injection (CWE-77)

2026-05-12 mongodb

GHSA-6m5j-p732-cfhq

Command Injection Ops Manager Mongodb Inc

9.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-reachable admin console with low complexity but requires webhook-config admin rights (PR:H); template execution breaks out to the host OS, so scope changes (S:C) with total C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 20:03 vuln.today

Patch available

May 12, 2026 - 20:03 EUVD

Severity Changed

May 12, 2026 - 19:22 NVD

HIGH CRITICAL

CVSS changed

May 12, 2026 - 19:22 NVD

7.2 (HIGH) 9.4 (CRITICAL)

CVE Published

May 12, 2026 - 18:37 nvd

CRITICAL 9.4

DescriptionCVE.org

An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.

This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.

AnalysisAI

Command injection in MongoDB Ops Manager (all 7.0 versions and 8.0.22 and prior) lets an administrative user with webhook-configuration rights achieve arbitrary command execution by embedding malicious FreeMarker template syntax in a webhook and then triggering it. The flaw is vendor-reported (MongoDB) with a patch in 8.0.23; there is no public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with SSVC's 'exploitation: none' rating despite the total technical impact.

Technical ContextAI

MongoDB Ops Manager is the on-premises platform for deploying, monitoring, backing up, and managing MongoDB clusters. Its alerting/integration subsystem allows administrators to configure webhooks whose payloads are rendered through the Apache FreeMarker template engine. FreeMarker exposes built-ins (e.g. object/class access and the 'execute' utility) that, when unsanitized user-controlled template directives are evaluated server-side, permit Server-Side Template Injection escalating to OS command execution. This maps to CWE-77 (Improper Neutralization of Special Elements used in a Command), where the root cause is that attacker-influenced template syntax is interpreted rather than treated as inert data. The affected CPE is cpe:2.3:a:mongodb,_inc.:ops_manager, confirming the Ops Manager application (not the MongoDB database server) is the vulnerable component.

RemediationAI

Vendor-released patch: upgrade to MongoDB Ops Manager 8.0.23 or later, which remediates the FreeMarker webhook command injection; 7.0.x users must migrate to a fixed 8.0.x line since all 7.0 versions are affected, per the release notes at https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-8.0.23. Where immediate patching is not possible, apply compensating controls: restrict which accounts hold Ops Manager global/organization administrative and webhook-configuration privileges (removing webhook-config rights from non-essential admins directly removes the attack surface, at the cost of reduced self-service integration), audit existing webhook definitions for unexpected FreeMarker directives such as class/object-access or execute built-ins, and place the Ops Manager management interface behind network segmentation and strong MFA to limit who can reach the admin console. Note these are mitigations only - they reduce exposure but do not close the underlying template-evaluation flaw, so upgrading remains the durable fix.