VULNERABILITY INTELLIGENCE

CVE-2026-8431

CVSS score7.2 HIGH
EPSS probability0.37%
CISA KEVNot currently listed
Published2026-05-12
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.  This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.

Weakness classification

  • cna@mongodb.com: CWE-77

Primary references