Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
#ALERT CVE-2026-81518 | CVSS 7.5 HIGH mongosqld TLS auth bypass: Client certs requested but not enforced, allowing unauthorized MongoDB data access when cert-based auth is sole protection. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/IGf32pz4m3
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mongodb | bi_connector | - | - | - |