Executive brief
MongoDB Server's configuration validation component has a case-sensitivity bug that can leave the authorization system disabled at startup. An attacker with network access to an affected server can perform unrestricted administrative operations without authentication, leading to complete compromise of data confidentiality, integrity, and availability.
Technical details
The vulnerability is a configuration validation flaw in MongoDB Server's authorization subsystem where improper case-sensitivity handling during server startup can result in authorization being disabled by default. The issue affects the component responsible for validating configuration options, allowing an unauthenticated attacker with network access to the MongoDB deployment to execute arbitrary administrative operations without authentication checks. This is a logic error rather than a memory corruption or injection vulnerability—the root cause is faulty validation logic that fails to correctly process configuration directives. The fix has been patched in versions 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and later.
Affected products
- MongoDB Server before 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Patched in versions 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and later