CVE-2026-82067

Awaiting Analysis Awaiting Analysis - Queue

Improper Case Handling in MongoDB Server Authorization Bypass

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: MongoDB, Inc.

Description

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-82067

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-178	The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper handling of case sensitivity in MongoDB Server's configuration validation. This flaw can cause the authorization subsystem to remain disabled during startup, allowing unauthenticated users with network access to perform administrative operations.

Impact Analysis

An attacker could exploit this to gain full administrative access to your MongoDB deployment. This may lead to unauthorized data access, modification, or deletion, compromising confidentiality, integrity, and availability of your data.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements such as GDPR's data protection principles or HIPAA's security rules. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Update MongoDB Server to the latest patched version immediately to address the improper case sensitivity handling in configuration validation. Ensure the authorization subsystem is enabled and verify its status during server startup.

Hi! I’m here to help you understand CVE-2026-82067. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70