CVE-2026-82053

HighCVSS 8.1/10Last modified Sep 16, 2026

Description

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control configuration, potentially allowing an authenticated user to acquire elevated privileges that were not intended by the deployment's authorization policy.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 8, 2026
Last modified: Sep 16, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-820546.5A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command include CVE-2026-820556.5A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a s CVE-2026-820565.3A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under c CVE-2026-820576.5A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By s CVE-2026-820586.5A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod CVE-2026-820596.5An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being re CVE-2026-82069.8The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeo CVE-2026-820605.4In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specia CVE-2026-820618.1A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges CVE-2026-820625.5A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the a CVE-2026-820635.3A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of servi CVE-2026-820647.5A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set mem