CVE-2026-13067
tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket
- State
- Published
- Severity
- 7.2 High
- Published
- Jul 22, 2026
- Updated
- Jul 24, 2026
- Reserved
- Jun 23, 2026
Description
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.2 High | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | mongodb |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N | mongodb |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
MongoDB ServerMongoDB |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.