Executive brief
MongoDB Server is a widely-used database that supports multiple authentication methods. A configuration weakness allows users with valid client certificates to authenticate via certificate-based methods even when administrators have explicitly disabled certificate authentication to enforce stricter security controls. This bypasses intended access restrictions and could allow unauthorized database access.
Technical details
The vulnerability is an authentication bypass in MongoDB Server's enforcement of the `authenticationMechanisms` configuration setting. The MONGODB-X509 (certificate-based) authentication path fails to respect the server's configured authentication restrictions, allowing a user with a valid client certificate and corresponding database account to authenticate via certificates even when the administrator has disabled that mechanism. This is a configuration bypass requiring a valid certificate and user account; the attacker cannot authenticate without pre-existing credentials. Patches are available in MongoDB versions 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0.
Affected products
- MongoDB Server before 8.2.13, 8.3.x before 8.3.8, 9.0.x before 9.0.0-rc2, 9.1.x before 9.1.0-rc0
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched