CVE-2026-87108

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-09

Last updated on: 2026-10-15

Assigner: MongoDB, Inc.

Description

An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-09

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-87108

EUVD

EUVD-2026-95491

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	ops_manager	From 7.0.0 (inc) to 7.0.23 (exc)
mongodb	ops_manager	From 8.0.0 (inc) to 8.0.27 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated Ops Manager user with read-only project access to retrieve daily host monitoring records from other projects if they have the correct record identifier. The issue stems from insufficient ownership validation, which may expose sensitive deployment metadata such as host and configuration details.

Detection Guidance

This vulnerability involves insufficient ownership validation in MongoDB Ops Manager. To detect it, review MongoDB Ops Manager logs for unauthorized access attempts to host monitoring records across projects. Check for read-only users retrieving records not belonging to their project. No specific commands are provided in the context.

Impact Analysis

An attacker with read-only access could gather unauthorized information about other projects' deployments, potentially leading to data leaks or enabling further attacks by understanding the environment setup.

Compliance Impact

The vulnerability allows unauthorized access to deployment metadata, including host and configuration details, which could expose sensitive data. This may impact compliance with GDPR (data protection) and HIPAA (health data privacy) by increasing the risk of unauthorized data disclosure.

Mitigation Strategies

Update MongoDB Ops Manager to the latest version to address the insufficient ownership validation issue. Ensure only authorized users have read-only project roles and restrict access to sensitive deployment metadata.

Hi! I’m here to help you understand CVE-2026-87108. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70