CVE-2026-13067
Received Received - Intake

MongoDB X.509 Role Validation Bypass via PROXY Protocol

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: MongoDB, Inc.

Description
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-23
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-13067
EUVD
EUVD-2026-47794

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mongodb mongodb *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper validation of roles derived from X.509 client certificates when PROXY protocol v2 is used on Unix domain sockets. This can lead to incorrect role assignments during MongoDB-X509 authentication, even with valid certificates from trusted authorities.

Detection Guidance

Detecting this vulnerability requires checking MongoDB configurations for PROXY protocol v2 usage on Unix domain sockets and verifying X.509 certificate role validation. Inspect MongoDB logs for authentication events and role assignments. Check if tlsCATrusts allow-list is properly configured and enforced.

Impact Analysis

An attacker with local access to the proxy Unix domain socket and a valid X.509 certificate could gain unintended elevated privileges or role assignments, potentially leading to unauthorized data access or modifications.

Compliance Impact

This vulnerability could lead to unauthorized access or privilege escalation, violating data protection requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Disable PROXY protocol v2 on Unix domain sockets if not required. Ensure X.509 client certificate roles are strictly validated against the tlsCATrusts allow-list. Restrict local access to the proxy Unix domain socket. Update MongoDB to the latest patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13067. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart