All vulnerabilities

Servers and applications

CVE-2026-18703

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intended to disable.

Severity
Low 2.3
Published
11 Aug 2026
Last changed
16 Sept 2026
Added to UpHeron
21 Oct 2026
Fixed in
8.3.8
Sources
NVD

Affected software

SoftwareAffected versions
MongoDBServers and applications · cpe:a:mongodb:mongodb
  • From 8.2.0 up to 8.2.12
  • From 8.3.0 before 8.3.8
  • Version 9.0.0-alpha0
  • Version 9.0.0-alpha1
  • Version 9.1.0-alpha0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-18703
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-18703