Vulnerability Intelligence Report
Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup
CVE-2026-82067
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and availability.
No Active Exploit Signals
CVSS Base Score
9.2
CRITICAL
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-178 ↗CWE-178: Improper Handling of Case Sensitivity
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| MongoDB | MongoDB Server | 8.3.0 < 8.3.9 (affected), 8.0.0 < 8.0.30 (affected), 7.0.0 < 7.0.41 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MongoDB, Inc. · Vendor · USA |
| Reserved | 2026-08-27T22:52:58 |
| Published | 2026-09-08T16:12:26 |
| Last Updated | 2026-09-08T17:54:23 |
Community Chatter & Buzz