CVE-2026-13067

MediumCVSS 6.3/10Last modified Oct 24, 2026

Description

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jul 22, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-130684.3An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a se CVE-2026-130696.5An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Enc CVE-2026-13076.5The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all v CVE-2026-130705.3A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer CVE-2026-130716.5An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute se CVE-2026-130728.1When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pip CVE-2026-130734.3An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation comman CVE-2026-130745.3An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to CVE-2026-130756.5An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $s CVE-2026-130766.5An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific CVE-2026-130777.1A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggre CVE-2026-130787.7A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading ho