CVE-2026-13067

Katalog CVE

CVSS 6.3 · Medium EPSS 0,10%

Kerentanan Incorrect Authorization pada mongodb. Skor CVSS 3.1 6.3 (Medium) menurut mongodb.com.

Deskripsi (NVD)

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.

Rincian

Terbit di NVD

22 Juli 2026

Terakhir diubah

5 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber mongodb.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,10% peluang dieksploitasi; lebih tinggi dari 0,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.mongodb.org/browse/SERVER-128387 advisory vendor · issue tracking