CVE-2026-8431CWE-77command-injection

CVE-2026-8431

High · published May 12, 2026

CVSS v3.1

7.2

EPSS

Percentile

52.8

In the wild

Unconfirmed

What it is

An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.

This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.

The record

Technical detail

CVSS v3.1: 7.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00705 · 52.8th percentile
Weakness: CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published: 2026-05-12T23:16Z

Affected products (1)

Product	Versions	Fixed in
mongodb/ops_manager	≥ 7.0.0, < 8.0.23	8.0.23

References (1)

https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-8.0.23 · [email protected]

EPSS history

Timeline

12 MAY 18:37Z
Ops Manager RCE via webhook body
cvelistv5