CVE-2026-81518

Katalog CVE

CVSS 7.5 · High EPSS 0,25%

Kerentanan Improper Certificate Validation pada mongodb bi connector. Skor CVSS 3.1 7.5 (High) menurut mongodb.com.

Deskripsi (NVD)

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.

Rincian

Terbit di NVD

28 Agustus 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber mongodb.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mongodb.com/docs/bi-connector/current/release-notes/ advisory vendor