CVE-2026-13067CWE-863broken-access-control

CVE-2026-13067

Medium · published July 23, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
0.7
In the wild
Unconfirmed
What it is

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00096 · 0.7th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-23T00:16Z
Affected products (2)
ProductVersionsFixed in
mongodb/mongodb≥ 8.0.0, < 8.0.288.0.28
mongodb/mongodb≥ 8.3.0, < 8.3.78.3.7
References (1)
https://jira.mongodb.org/browse/SERVER-128387 · [email protected]
EPSS history
Timeline
  • 22 JUL 19:16Z
    tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket
    cvelistv5