Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-82053

Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment

CVSS 4.0 7.6 HIGHCVSS 3.1 8.1 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-82053

Published

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control configuration, potentially allowing an authenticated user to acquire elevated privileges that were not intended by the deployment's authorization policy.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-82053

Published

MongoDB Server

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "MongoDB",
                    "product": "MongoDB Server",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "8.3.0",
                            "lessThan": "8.3.9",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "8.0.0",
                            "lessThan": "8.0.30",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "7.0.0",
                            "lessThan": "7.0.41",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON