CVE-2026-82053
- Source
- https://cve.org/CVERecord?id=CVE-2026-82053
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82053.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-82053
- Aliases
- Downstream
- Published
- 2026-09-08T16:12:16Z
- Modified
- 2026-09-18T08:11:05Z
- Severity
-
- 7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment
- Details
-
A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control configuration, potentially allowing an authenticated user to acquire elevated privileges that were not intended by the deployment's authorization policy.
- Database specific
{ "cna_assigner": "mongodb", "cwe_ids": [ "CWE-863" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82053.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "8.3.0" }, { "fixed": "8.3.9" }, { "introduced": "8.0.0" }, { "fixed": "8.0.30" }, { "introduced": "7.0.0" }, { "fixed": "7.0.41" } ], "source": "AFFECTED_FIELD" } ] }- References
Affected packages
Git / github.com/mongodb/mongo
Affected ranges
- Type
- GIT
- Repo
- https://github.com/mongodb/mongo
- Events
-
IntroducedFixedIntroducedFixedIntroducedLast AffectedIntroducedFixedIntroducedLast Affected
- Database specific
-
Show details
{ "cpe": [ "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*", "cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:*:*:-:-:*:*", "cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:*:*:-:-:*:*" ], "extracted_events": [ { "introduced": "7.0.0" }, { "fixed": "7.0.41" }, { "introduced": "8.0.0" }, { "fixed": "8.0.30" }, { "introduced": "8.2.0" }, { "last_affected": "8.2.12" }, { "introduced": "8.3.0" }, { "fixed": "8.3.9" }, { "introduced": "9.0.0-alpha0" }, { "last_affected": "9.0.0-alpha0" }, { "introduced": "9.0.0-alpha1" }, { "last_affected": "9.0.0-alpha1" } ], "source": [ "CPE_RANGE", "CPE_STRING" ] }
Affected versions
9.*
9.0.0-alpha0
9.0.0-alpha1
r7.*
r7.0.0
r7.0.1
r7.0.1-rc0
r7.0.10
r7.0.10-rc0
r7.0.11
r7.0.11-rc0
r7.0.11-rc1
r7.0.11-rc2
r7.0.12
r7.0.12-rc0
r7.0.12-rc1
r7.0.13
r7.0.13-rc0
r7.0.13-rc1
r7.0.14
r7.0.14-rc0
r7.0.15
r7.0.15-rc0
r7.0.15-rc1
r7.0.16
r7.0.16-rc0
r7.0.16-rc1
r7.0.17
r7.0.18
r7.0.2
r7.0.2-rc0
r7.0.2-rc1
r7.0.2-rc2
r7.0.21
r7.0.21-alpha0
r7.0.21-rc0
r7.0.22
r7.0.22-rc0
r7.0.23
r7.0.23-rc0
r7.0.23-rc1
r7.0.24
r7.0.24-rc0
r7.0.25-alpha0
r7.0.26
r7.0.26-rc0
r7.0.27
r7.0.27-alpha0
r7.0.27-rc0
r7.0.3
r7.0.3-rc0
r7.0.3-rc1
r7.0.35
r7.0.4
r7.0.4-rc0
r7.0.5
r7.0.5-rc0
r7.0.6
r7.0.6-rc0
r7.0.7
r7.0.7-rc0
r7.0.7-rc1
r7.0.7-rc2
r7.0.8
r7.0.8-rc0
r7.0.9
r7.0.9-rc0
r7.0.9-rc1
r8.*
r8.0.0
r8.0.1
r8.0.1-rc0
r8.0.10
r8.0.10-rc0
r8.0.12
r8.0.12-rc0
r8.0.13
r8.0.13-rc0
r8.0.13-rc1
r8.0.13-rc2
r8.0.14
r8.0.14-rc0
r8.0.14-rc1
r8.0.16
r8.0.16-rc0
r8.0.16-rc1
r8.0.17-alpha0
r8.0.2
r8.0.24
r8.0.3
r8.0.4
r8.0.4-rc0
r8.0.5
r8.0.5-rc0
r8.0.5-rc1
r8.0.5-rc2
r8.0.6
r8.2.0
r8.2.1
r8.2.1-rc0
r8.2.1-rc1
r8.2.10
r8.2.12
r8.2.2
r8.2.2-rc0
r8.2.3-alpha0
r8.2.4-alpha0
r8.2.4-alpha1
r8.3.0
r8.3.3
r9.*
r9.0.0-alpha0
r9.0.0-alpha1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82053.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"66908565863182878949263117251652046873",
"81045179624099588995371526936867447218",
"40887363166120728720864979839570738440",
"256732394880312722171336173841003327192",
"189479856184880563329078480903896694545",
"175148206283301428432002867622286913085",
"305665546638865113923099657246304323513"
],
"threshold": 0.9
},
"id": "CVE-2026-82053-7518edcc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/11c3ed7c274d5fb7149e498323bd0377c3a2876e",
"target": {
"file": "src/mongo/util/observable_mutex_registry.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "97328004591881352222915931748724594831",
"length": 772
},
"id": "CVE-2026-82053-77577a26",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/6df23543fc9e7ee456ff05ed726b22865ea753e7",
"target": {
"file": "src/mongo/db/pipeline/document_source_list_catalog.cpp",
"function": "DocumentSourceListCatalog::createFromBson"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"165410231648936824589980198196954162537",
"136501663843339022690751043996234207290",
"285354211900527027711069075030245862327",
"118881528740665335694743800161340085998",
"36266064472550105418329813861525007356",
"16931947150780577515020757191522828473"
],
"threshold": 0.9
},
"id": "CVE-2026-82053-ba1994eb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/6df23543fc9e7ee456ff05ed726b22865ea753e7",
"target": {
"file": "src/mongo/db/pipeline/document_source_list_catalog.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"15118513725026685067664956440423785894",
"4881464334735159279508803095757659276",
"266758334235923098891166228361922998690",
"287039910505335082692569496912566155170",
"215343628858689419312915919625353446408",
"80950900741330922061414046051663341667",
"48699755411854371597904640594615452680",
"299434378678909034395123214857676742507",
"320443038501231526517453934170620795671",
"37185450870766536639064978090208934675",
"330071214781083562802997609052830790317",
"112905490564973162584994830096370086935"
],
"threshold": 0.9
},
"id": "CVE-2026-82053-c539edfe",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/6df23543fc9e7ee456ff05ed726b22865ea753e7",
"target": {
"file": "src/mongo/db/pipeline/document_source_list_catalog.cpp"
}
}
]
vanir_signatures_modified
"2026-09-18T08:11:05Z"