CVE-2026-82067
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and availability.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.2
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.28%
- CWE
- CWE-178
- Published
- 2026-09-08
- Last modified
- 2026-09-08
Affected products
- MongoDB MongoDB Server
- MongoDB MongoDB Server
- MongoDB MongoDB Server
Weakness type
Related vulnerabilities
- CVE-2026-87876 — Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)
- CVE-2026-86770 — Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
- CVE-2021-48006 — PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity
- CVE-2026-84428 — fastify vulnerable to header validation bypass via incomplete schema case normalization
- CVE-2026-73476 — External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
- CVE-2026-84303 — gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
- CVE-2026-73270 — httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems
- CVE-2026-83612 — xmldom: HTML raw-text closing-tag case mismatch causes output amplification