MongoDB Controllers EUVD-2026-92817

Exploitation requires two concrete preconditions: (1) the deployment must be using Enterprise Ops Manager backup reconciliation (the affected code path only builds backup-store admin API request paths in that mode), and (2) the attacker must possess Kubernetes RBAC permissions to modify an OpsManager custom resource (PR:L). The limiting factors that reduce real-world risk are the non-default backup-reconciliation feature requirement (reflected as AT:P), the need for existing authenticated cluster write access to the CR rather than anonymous network access, and the fact that impact is confined to low-integrity unintended administrative changes in Ops Manager (VC:N/VA:N) with no confidentiality or availability loss and no scope change.

All signals point to a genuinely LOW-priority issue rather than a high-CVSS-but-hyped one. The vendor-assigned CVSS 4.0 base score is 2.3 (Low) with vector AV:N/AC:L/AT:P/PR:L/UI:N and impact limited to VI:L (low integrity) only - no confidentiality or availability impact and no scope change to subsequent systems. The AT:P metric signals that specific attack requirements must exist (the deployment must use Enterprise Ops Manager backup reconciliation), and PR:L confirms the attacker must already hold valid, if low, privileges - specifically the Kubernetes RBAC ability to modify an OpsManager custom resource. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation would be an authenticated, config-dependent insider or supply-chain scenario rather than opportunistic mass exploitation. The one point worth flagging: the input vector carries AV:N (network), but the real precondition is cluster-level write access to a custom resource, which is closer to an authenticated-insider threat than anonymous network reach - the network vector reflects that the operator relays the forged request over the network to Ops Manager, not that an unauthenticated internet attacker can trigger it. Overall this is a low-urgency, patch-on-normal-cycle item.

A user who already holds Kubernetes RBAC permissions to edit an OpsManager custom resource supplies a crafted backup store identifier; because the operator does not escape that identifier when building Ops Manager admin API request paths, the operator issues a forged (SSRF) request to an unintended Ops Manager admin endpoint, causing unintended administrative changes. No public exploit code was identified at time of analysis, and the attack only works where Enterprise Ops Manager backup reconciliation is in use.