CVE-2026-18703
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intended to disable.
Risk Assessment
The risk includes potential bypass of intended authentication policies, leading to unauthorized system access.
Recommendation
It is recommended to update MongoDB Server to a patched version and review authentication method configurations and certificates.
Original NVD description (English source)
An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intended to disable.