CVE-2026-82067

EUVD-2026-72954
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and availability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mongodbCNA
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
mongodbmongodb
8.3.0 ≤
𝑥
< 8.3.9
CNA
mongodbmongodb
8.0.0 ≤
𝑥
< 8.0.30
CNA
mongodbmongodb
7.0.0 ≤
𝑥
< 7.0.41
CNA
Common Weakness Enumeration
References
https://jira.mongodb.org/browse/SERVER-131229