CVE-2026-8431
Ops Manager RCE via webhook body
- State
- Published
- Severity
- 9.4 Critical
- Published
- May 12, 2026
- Updated
- May 12, 2026
- Reserved
- May 12, 2026
Description
An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.
This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | mongodb |
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | mongodb |
Weaknesses
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected Products
| Product | Versions |
|---|---|
Ops ManagerMongoDB, Inc. |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.