Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-13067

tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 8.0 to < 8.0.28affected
  • 8.3.0 to < 8.3.7affected

References