Vulnerability · Published Jul 22, 2026 · Assigned by mongodb
CVE-2026-13067tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket
Medium 6.3
In plain English
A medium-severity incorrect authorization in MongoDB Server from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | MongoDB Server | 8.0 – before 8.0.288.3.0 – before 8.3.7 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N