CVE-2026-103546

Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

State: Published
Severity: 2.3 Low
Published: Oct 5, 2026
Updated: Oct 6, 2026
Reserved: Sep 30, 2026

Description

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	mongodb
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	mongodb

Weaknesses

CWE-918 Server-Side request forgery (SSRF)

Affected Products

Product	Versions
Mongodb Controllers for KubernetesMongoDB, Inc.	before 1.13.0Affected

References

https://github.com/mongodb/mongodb-kubernetes/releases/tag/1.13.0release-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.