CVE-2026-13067

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-13067
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13067.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-13067
Downstream
Published
2026-07-22T19:16:38.192Z
Modified
2026-08-07T03:46:13.377032051Z
Severity
  • 7.2 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket
Details

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.

Database specific 
{
    "cna_assigner": "mongodb",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "fixed": "8.0.28"
                },
                {
                    "introduced": "8.3.0"
                },
                {
                    "fixed": "8.3.7"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13067.json",
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/mongodb/mongo

Affected ranges

Type
GIT
Repo
https://github.com/mongodb/mongo
Events
Introduced
b41cda4fe697dce6fd9b83b3805362ccc02fbeb3
Fixed
dc5344b376fdfab0fe5b2982f125c056ab0abcd8
Introduced
0f29b043a58fdd251ce0a0b32754b8459613c933
Fixed
527067edda13efcac3d257b3cdb1c510c57b3c6e
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.28"
        },
        {
            "introduced": "8.3.0"
        },
        {
            "fixed": "8.3.7"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

r8.*
r8.0.0
r8.0.1
r8.0.1-rc0
r8.0.10
r8.0.10-rc0
r8.0.12
r8.0.12-rc0
r8.0.13
r8.0.13-rc0
r8.0.13-rc1
r8.0.13-rc2
r8.0.14
r8.0.14-rc0
r8.0.14-rc1
r8.0.16
r8.0.16-rc0
r8.0.16-rc1
r8.0.17-alpha0
r8.0.2
r8.0.24
r8.0.3
r8.0.4
r8.0.4-rc0
r8.0.5
r8.0.5-rc0
r8.0.5-rc1
r8.0.5-rc2
r8.0.6
r8.3.0
r8.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13067.json"