CVE-2026-87109

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-09

Last updated on: 2026-10-15

Assigner: MongoDB, Inc.

Description

An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-09

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-87109

EUVD

EUVD-2026-95492

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	ops_manager	From 7.0.0 (inc) to 7.0.23 (exc)
mongodb	ops_manager	From 8.0.0 (inc) to 8.0.27 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This leads to the disclosure of secret authentication material to another member of the same organization or project.

Detection Guidance

This vulnerability involves unauthorized access to pending authenticator enrollment seeds via user-listing endpoints in MongoDB Ops Manager. To detect it, review logs for unusual access to user-listing endpoints by authenticated members during unconfirmed enrollment periods. Check for repeated or suspicious queries targeting these endpoints.

Impact Analysis

An attacker with access to the system could gain unauthorized access to another user's account by obtaining their authenticator enrollment seed. This could allow the attacker to impersonate the victim or bypass multi-factor authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Immediately update MongoDB Ops Manager to the latest patched version. Restrict access to user-listing endpoints to authorized personnel only. Monitor and audit user activities for any unauthorized access attempts. Disable or review pending authenticator enrollment processes until a fix is applied.

Hi! I’m here to help you understand CVE-2026-87109. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70