Executive brief
A security issue in MongoDB Server could allow a local user to gain unauthorized access levels within the database. When specific networking protocols are used, the system may fail to properly verify the permissions associated with a user's digital certificate. This could lead to a user performing actions or accessing data they are not officially permitted to see, potentially compromising sensitive information.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in MongoDB Server's handling of PROXY protocol v2 over Unix domain sockets. When MONGODB-X509 authentication is utilized in this configuration, the server may bypass validation of roles derived from client certificates against the configured tlsCATrusts allow-list. An attacker with local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted CA could achieve unintended role assignments. The issue is addressed in MongoDB Server versions 8.0.28 and 8.3.7.
Affected products
- MongoDB MongoDB Server 8.0.0 to 8.0.27, 8.3.0 to 8.3.6
Timeline
- 2026-07-22: advisory
- 2026-07-22: disclosed