CVE-2026-103546CWE-918ssrf

CVE-2026-103546

Medium · published October 6, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
4.0
In the wild
Unconfirmed
What it is

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
2.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00152 · 4.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-10-06T02:16Z
References (1)
https://github.com/mongodb/mongodb-kubernetes/releases/tag/1.13.0 · [email protected]
EPSS history
Timeline
  • 07 OCT 03:39Z
    EPSS moved — → 0%
    epss
  • 05 OCT 21:50Z
    Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator
    cvelistv5