Security readout for executives and security teams
Plain-English summary
MongoDB Server may grant unintended roles when certificate-based authentication passes through PROXY protocol v2 on a Unix domain socket. An attacker still needs local socket access and a valid certificate from a trusted authority. Successful abuse could expose or alter sensitive database information, but the supplied sources do not report active exploitation.
Executive priority
Prioritize prompt configuration review for affected MongoDB environments handling sensitive data. Escalate systems combining the Unix socket, PROXY v2, MONGODB-X509, and tlsCATrusts conditions. Immediate emergency response is not supported by current exploitation evidence, but high confidentiality and integrity impact warrants timely remediation planning.
Technical view
The Unix-socket PROXY protocol v2 path may fail to enforce the configured tlsCATrusts allow-list against roles derived from X.509 client certificates. Following MONGODB-X509 authentication, this authorization failure could assign unintended roles. The issue is classified as CWE-863 and scored CVSS 4.0 7.2, with high confidentiality and integrity impact but no availability impact.
Likely exposure
Exposure appears limited to MongoDB Server deployments using MONGODB-X509 authentication with PROXY protocol v2 over a Unix domain socket. Local socket access and a trusted-CA certificate are prerequisites. The bundle names versions 8.0 and 8.3.0, but does not provide a precise affected range; other versions default to unaffected.
Exploitation context
No active exploitation is established: the CVE is not listed as KEV in the supplied bundle, and no cited source reports exploitation. Abuse requires local access, a valid trusted-CA certificate, and the affected proxy and authentication configuration, substantially narrowing reachability compared with a remotely exploitable flaw.
Researcher notes
The flaw is an authorization-check omission involving certificate-derived roles, not a certificate-forgery issue. Assessment should verify the exact data path and compare assigned roles with the tlsCATrusts allow-list without attempting destructive actions. Public evidence supplied here does not identify a fixed version, patch, proof of concept, or observed attacks.
Mitigation direction
- Check MongoDB's advisory for corrected releases or configuration guidance.
- Restrict Unix domain socket access to essential service accounts only.
- Disable PROXY protocol v2 on the Unix socket if operationally unnecessary.
- Review trusted certificate authorities and revoke unnecessary client certificates.
- Apply the vendor-supported fix when MongoDB identifies one.
Validation and detection
- Inventory MongoDB Server versions, especially 8.0 and 8.3.0.
- Identify Unix sockets configured to accept PROXY protocol v2.
- Confirm whether MONGODB-X509 authentication and tlsCATrusts are configured together.
- Audit socket permissions and local principals able to connect.
- Review authentication and authorization logs for unexpected X.509-derived roles.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-13067 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——mongodbCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N15.2mongodbVulnerability scoring details
Base CVSS 4.0 score
7.2HighVector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
6.3MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://jira.mongodb.org/browse/SERVER-128387CVE reference, mongodb
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.