MongoDB Ops Manager EUVD-2026-95492

Exploitation requires the attacker to be an authenticated member of the same MongoDB Ops Manager organization or project (PR:L) and to access user-listing endpoints. The critical precondition (reflected as AT:P) is that the targeted victim must have an authenticator enrollment that is pending and not yet confirmed - the secret seed is only exposed during this unconfirmed enrollment window, so once the victim completes/confirms enrollment the exposure closes. Limiting factors that reduce real-world risk: valid same-tenant authentication is mandatory (no anonymous access), exploitation is confined to a transient enrollment timing window outside the attacker's direct control, and the issue is fixed in Ops Manager Server 8.0.27 (earlier versions affected). Impact is limited to disclosure of authentication material; there is no direct integrity or availability effect.

This is a genuine but moderate-priority issue rather than an urgent emergency. The vendor CVSS 4.0 base score is 6.0 (Medium), and the vector is internally consistent with the description: AV:N (exploited over the network via user-listing API/UI endpoints), AC:L (no attacker-side complexity), but AT:P - a required condition exists, namely that the victim's authenticator enrollment must be in a pending/unconfirmed state. Critically, PR:L confirms the attacker must already be an authenticated, low-privileged member of the same organization or project, so this is NOT a remote-unauthenticated flaw; it is an insider/tenant-isolation confidentiality break. Impact is VC:H (high confidentiality - disclosure of a secret authenticator enrollment seed) with VI:N/VA:N (no integrity or availability impact), matching CWE-201. There is no CISA KEV listing and no public exploit identified at time of analysis; no EPSS score, SSVC decision, or POC was supplied in the input, so exploitation-probability signals are simply absent rather than conflicting. The practical risk is bounded by two strong limiting factors - required authentication within the same tenant and a narrow timing window during an unconfirmed enrollment - which together make opportunistic mass exploitation unlikely, though a malicious or compromised co-tenant could realistically weaponize it to undermine another member's MFA.

A malicious or compromised low-privileged member of a MongoDB Ops Manager organization waits for (or coincides with) another member beginning authenticator (MFA/TOTP) enrollment. Before that member confirms enrollment, the attacker queries a user-listing endpoint that improperly includes the pending enrollment seed, capturing the victim's secret authenticator material and enabling them to generate valid one-time codes. No public exploit code is identified at time of analysis, and success depends on catching the victim's enrollment while it remains unconfirmed.