p PatchFirst

CVE-2026-82053

CVE-2026-82053 · Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control configuration, potentially allowing an authenticated user to acquire elevated privileges that were not intended by the deployment's authorization policy.

CVSS 7.6 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • mongodb server

    Versions
    • ≥ 8.3.0, < 8.3.9: Affected (semver)
    • ≥ 8.0.0, < 8.0.30: Affected (semver)
    • ≥ 7.0.0, < 7.0.41: Affected (semver)

    Update to 7.0.41; Update to 8.0.30; Update to 8.3.9

  • mongodb Ubuntu:Pro:14.04:LTS

    Versions
    • 1:2.4.6-0ubuntu5
    • 1:2.4.6-0ubuntu6
    • 1:2.4.8-1ubuntu1
    • 1:2.4.8-2
    • 1:2.4.9-1
    • 1:2.4.9-1ubuntu1
    • 1:2.4.9-1ubuntu2
    • 1:2.4.9-1ubuntu2+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mongodb Ubuntu:Pro:16.04:LTS

    Versions
    • 1:2.6.10-0ubuntu1
    • 1:2.6.10-0ubuntu1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mongodb Ubuntu:Pro:18.04:LTS

    Versions
    • 1:3.4.7-1
    • 1:3.4.7-1ubuntu1
    • 1:3.4.7-1ubuntu2
    • 1:3.4.7-1ubuntu4
    • 1:3.4.14-3ubuntu1
    • 1:3.4.14-3ubuntu2
    • 1:3.6.3-0ubuntu1
    • 1:3.6.3-0ubuntu1.1
    • 1:3.6.3-0ubuntu1.3
    • 1:3.6.3-0ubuntu1.4
    • 1:3.6.3-0ubuntu1.4+esm1
    • 1:3.6.3-0ubuntu1.4+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mongodb Ubuntu:Pro:20.04:LTS

    Versions
    • 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu2
    • 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5
    • 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2
    • 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3
    • 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →