EUVD-2026-56861
GHSA-h22h-g2cf-r8hr
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires a trusted certificate plus matching account (PR:L, AC:H); scope unchanged within MongoDB; no availability impact described.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intended to disable.
AnalysisAI
MongoDB Server 8.3.x through 8.3.7 permits certificate-based authentication to succeed for a client holding a valid x.509 certificate and a corresponding user account, even when the administrator has explicitly configured the server to restrict allowable authentication mechanisms to other methods such as SCRAM. The vulnerability undermines deliberate access-control policy decisions rather than enabling unauthenticated access, meaning the attacker must already possess legitimate credential material. With a CVSS 4.0 score of 2.3, CISA SSVC exploitation status of 'none', and no public exploit identified at time of analysis, this is a low-urgency compliance and policy-integrity issue rather than an imminent exploitation threat.
Technical ContextAI
MongoDB Server supports multiple authentication mechanisms, including SCRAM-SHA-1, SCRAM-SHA-256, and x.509 certificate-based authentication, configurable via the authenticationMechanisms server parameter in mongod.conf or at runtime via setParameter. CWE-863 (Incorrect Authorization) identifies the root cause: the server's enforcement of the configured mechanism allowlist is insufficiently rigorous, allowing the x.509 authentication path to succeed for a client even when that mechanism has been removed from the administrator-defined allowable set. The affected CPE is cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:*, with EUVD-2026-56861 narrowing the confirmed vulnerable range to the 8.3.x release line (8.3.0 through 8.3.7). The flaw is tracked upstream in MongoDB JIRA ticket SERVER-127863.
RemediationAI
Upgrade MongoDB Server to version 8.3.8 or later, which contains the vendor-released patch per JIRA ticket SERVER-127863 (https://jira.mongodb.org/browse/SERVER-127863); the fix boundary of 8.3.8 is confirmed by the EUVD-2026-56861 affected-version range. Where immediate upgrade is not feasible, administrators should audit MongoDB user accounts to identify all accounts that have an associated x.509 subject DN and temporarily revoke or expire the corresponding certificates at the CA or via mongod's certificate trust store - note that this will break legitimate certificate-based logins for those accounts until re-issuance. Additionally, review MongoDB audit logs (if auditLog is configured) for x.509 authentication events to detect any unauthorized use of this path. Verify the authenticationMechanisms configuration post-patch to confirm the intended policy is correctly enforced.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today