EUVD-2026-95491
GHSA-w8qp-gqxj-mpmx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as read-only project user
-
ExploitRequest host monitoring record ID from another project
-
ImpactRetrieve exposed deployment and host metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires an authenticated Ops Manager account that holds at least a read-only role on some project (PR:L), AND possession of the exact identifier of a target daily host monitoring record belonging to a different project (the AT:P attack requirement). The attacker cannot discover records they have no identifier for through this flaw alone, which is the primary limiting factor; impact is confined to disclosure of host and configuration metadata (VC:L) with no write or availability effect. Exploitable over the network with no user interaction once those two prerequisites are met. |
| Impact | This is a genuinely low-priority issue, and the signals are consistent in saying so. The vendor (MongoDB) CVSS 4.0 vector scores it 2.3 - AV:N but with PR:L (requires an authenticated account), AT:P (a specific attack requirement, namely possession of a valid record identifier from another project), and only VC:L with no integrity or availability impact. This is a textbook IDOR/broken-object-level-authorization flaw (CWE-639), not a high-impact breach. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of exploitation interest: exploitation status is 'no public exploit identified at time of analysis.' The one notable data-quality concern is that the input Tag 'Authentication Bypass' conflicts with both the description (the attacker is already authenticated) and CWE-639 (authorization bypass) - this should be read as an authorization/object-reference flaw, not an authentication bypass. No CVSS 3.1 vector was supplied, only the 4.0 vector; the PR:L in that vector is the basis for the 'authenticated' qualifier used below. Net: real but very low risk, gated by existing access and knowledge of a specific identifier. |
| Exploit ScenarioDerived | An authenticated Ops Manager user who holds only a read-only role on one project, but who has obtained (or guessed/enumerated) the identifier of a daily host monitoring record belonging to a different project, requests that record directly. Because ownership is not validated against the caller's project membership, the server returns the cross-project record, leaking host and deployment configuration metadata. No public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Read-only authenticated users of MongoDB Ops Manager can retrieve daily host monitoring records belonging to projects they do not have access to, exposing deployment metadata such as host and configuration details, when they already know the exact identifier of the target record. Exploitation requires a valid Ops Manager account with at least a read-only role on some project plus knowledge of a record identifier from a different project, which sharply limits practical exposure; impact is confined to low-severity information disclosure with no write or availability effect. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), consistent with the vendor-assigned CVSS 4.0 score of 2.3 and our independent CVSS 3.1 assessment of AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N.
RemediationAI
Patch available per vendor advisory: the provided reference points to the MongoDB Ops Manager release notes for Ops Manager Server 8.0.27 (https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#ops-manager-server-8027), so upgrading Ops Manager Server to that release - or to the latest available release in the supported train - is the primary fix, and the exact patched version should be confirmed against that release-notes page before scheduling the upgrade. Because exploitation requires an already-authenticated account and prior possession of a valid cross-project record identifier, the practical risk between disclosure and patch is small, but compensating controls are still worthwhile: restrict Ops Manager API and UI access to trusted management networks so that only known operators can reach the record endpoints, apply strict least-privilege to read-only project roles and review who currently holds them (trade-off: reduces the pool of accounts that could exercise the flaw but does not eliminate it for legitimate read-only users), and monitor Ops Manager access logs for read-only principals requesting monitoring-record endpoints whose identifiers fall outside the projects they are a member of (trade-off: requires log ingestion and baseline tuning, and cannot block the request in real time). Treating host monitoring record identifiers as sensitive values - avoiding their inclusion in tickets, exports, chat transcripts, or logs accessible to lower-privileged users - removes the AT:P prerequisite that the attacker must already know the key, though this is an operational hygiene measure rather than an enforceable control. There is no indication that disabling host monitoring is a reasonable workaround, since doing so would remove core Ops Manager functionality disproportionate to a low-severity metadata disclosure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MongoDB Ops Manager is MongoDB's self-managed platform for automated deployment, monitoring, backup, and configuration management of MongoDB clusters; its daily host monitoring records contain deployment metadata including host identity and configuration details. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), the classic insecure direct object reference pattern: the API path that serves a daily host monitoring record uses a caller-supplied record identifier as the database lookup key without verifying that the record's owning project matches a project the caller is entitled to read. Because the ownership check is missing rather than the authentication check, a fully authenticated user with a legitimate read-only role on any project can pull a record that belongs to another project simply by presenting that record's identifier. The key mitigating factor is that the identifier is not discoverable through this endpoint itself (no enumeration or listing is exposed by the flaw), so the attacker must obtain the key from another source, which the CVSS 4.0 vector captures through AT:P, and the vendor-supplied tag of "Authentication Bypass" is a loose characterization - authentication is still required, and the actual defect is an authorization/ownership validation gap. No CPE strings were supplied with the advisory data, so the precise affected version matrix is not enumerated here.
Know when Ops Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated low-priv user so PR:L; needing a valid cross-project record identifier maps the 4.0 AT:P requirement to AC:H; only metadata disclosure, so C:L and I/A:N.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
1DescriptionCVE.org
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Ops Manager
View allCommand injection in MongoDB Ops Manager (all 7.0 versions and 8.0.22 and prior) lets an administrative user with webhoo
Unauthenticated remote request flooding against MongoDB Ops Manager's monitoring HTTP endpoints can temporarily slow oth
Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key
An authenticated member of a MongoDB Ops Manager organization can retrieve another organization or project member's pend
For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turne
Exploit-DB