CVE-2026-81518

Awaiting Analysis Awaiting Analysis - Queue

mongosqld TLS Client Certificate Authentication Bypass

Publication date: 2026-08-28

Last updated on: 2026-08-31

Assigner: MongoDB, Inc.

Description

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-31

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81518

EUVD

EUVD-2026-67934

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability involves mongosqld, a MongoDB connector, which when configured with a client certificate authority file, requests a client certificate during TLS handshake but does not enforce its presence. This allows clients without certificates to still connect, bypassing authentication in deployments relying solely on client certificates for user identification.

Detection Guidance

Check if mongosqld is configured with a client certificate authority file and verify if client certificates are required during TLS handshake. Inspect network traffic for sessions established without client certificates when they should be required.

Impact Analysis

If you use mongosqld with client certificate authentication, an attacker with network access could connect without a valid certificate, read exposed MongoDB data, and potentially gain unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating compliance requirements for data protection and privacy such as GDPR and HIPAA, which mandate strict access controls and data security measures.

Mitigation Strategies

Configure mongosqld to require client certificates during TLS handshake. Update the listener settings to enforce client certificate validation as the sole means of user identification.

Hi! I’m here to help you understand CVE-2026-81518. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70