CVE-2026-13067

Analyzed Analyzed - Analysis Complete

MongoDB X.509 Role Validation Bypass via PROXY Protocol

Publication date: 2026-07-22

Last updated on: 2026-08-05

Assigner: MongoDB, Inc.

Description

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-05

Generated

2026-08-12

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-13067

EUVD

EUVD-2026-47794

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	From 8.0.0 (inc) to 8.0.28 (exc)
mongodb	mongodb	From 8.3.0 (inc) to 8.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper validation of roles derived from X.509 client certificates when PROXY protocol v2 is used on Unix domain sockets. This can lead to incorrect role assignments during MongoDB-X509 authentication, even with valid certificates from trusted authorities.

Detection Guidance

Detecting this vulnerability requires checking MongoDB configurations for PROXY protocol v2 usage on Unix domain sockets and verifying X.509 certificate role validation. Inspect MongoDB logs for authentication events and role assignments. Check if tlsCATrusts allow-list is properly configured and enforced.

Impact Analysis

An attacker with local access to the proxy Unix domain socket and a valid X.509 certificate could gain unintended elevated privileges or role assignments, potentially leading to unauthorized data access or modifications.

Compliance Impact

This vulnerability could lead to unauthorized access or privilege escalation, violating data protection requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Disable PROXY protocol v2 on Unix domain sockets if not required. Ensure X.509 client certificate roles are strictly validated against the tlsCATrusts allow-list. Restrict local access to the proxy Unix domain socket. Update MongoDB to the latest patched version if available.

Hi! I’m here to help you understand CVE-2026-13067. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70