CVE-2026-87108
Received Received - Intake

Authenticated Read-Only Access to Cross-Project Host Monitoring Data in MongoDB Ops Manager

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: MongoDB, Inc.

Description
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-87108
EUVD
EUVD-2026-95491

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
MongoDB Ops Manager 7.0.0
MongoDB Ops Manager 8.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated Ops Manager user with read-only project access to retrieve daily host monitoring records from other projects if they have the correct record identifier. The issue stems from insufficient ownership validation, which may expose sensitive deployment metadata such as host and configuration details.

Impact Analysis

An attacker with read-only access could gather unauthorized information about other projects' deployments, potentially leading to data leaks or enabling further attacks by understanding the environment setup.

Mitigation Strategies

Update MongoDB Ops Manager to the latest version to address the insufficient ownership validation issue. Ensure only authorized users have read-only project roles and restrict access to sensitive deployment metadata.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87108. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart