CVE-2026-82067Disclosure(mongodb / mongodb)

LOWCVSS 9.2 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch mongodb mongodb systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and availability.

mongodb CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://jira.mongodb.org/browse/SERVER-131229

Weakness type (CWE)

CWE-178

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mongodb

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
2 total mentions across 1 day

Affected systems

Vendors

mongodb

Products

mongodb

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Full discourse2 posts

Upwind Security MDR@UpwindMDR46d
Disclosure
🚨High - MongoDB Server Auth Disabled via Case-Sensitive Config Validation (CVE-2026-82067) MongoDB Server config validation mishandles case sensitivity during startup, allowing authorization to remain disabled if auth-related keys are cased incorrectly. An unauthenticated network attacker can then connect and perform arbitrary administrative operations, resulting in full CIA compromise. 👉Affected: MongoDB Server (versions TBD)
Post summary
MongoDB Server’s case‑sensitive configuration validation flaw can leave authentication disabled, allowing unauthenticated attackers to perform arbitrary administrative actions, leading to full CIA compromise.
0000059
303 followersView on X
DFIR Lab@DFIR_Lab46d
Patch
🚨 HIGH SEVERITY: CVE-2026-82067 (CVSS 8.1) MongoDB Server authorization bypass via case sensitivity flaw. Unauthenticated attackers can gain full admin access. Patch immediately! #CVE #Vulnerability #PatchNow #ThreatIntel #DFIR https://t.co/KaE8gjVWdK
Post summary
A high‑severity MongoDB authorization bypass (CVE‑2026‑82067) is announced, with clear patch guidance and technical details on the case‑sensitivity flaw.
0000038
130 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mongodb	mongodb	-	-	-

Explore more

Back to dashboard mongodb CVEs mongodb vulnerabilities