CVE-2026-120808NVD
Vulnerability Summary
An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connections to IPv6-addressed peers. When a MongoDB process using the Apple SecureTransport TLS backend connects to an IPv6 target, the trust evaluation result from SecTrustEvaluate is silently discarded, regardless of whether the peer's certificate is trusted. An on-path party could exploit this by presenting a self-signed certificate containing the target's IPv6 address in the Subject Alternative Name to intercept and modify encrypted inter-node or external service traffic. This issue only affects MongoDB processes running on macOS with the Apple SecureTransport TLS provider.
CVSS v4.0 Base Metrics — Score 9.1 (CRITICAL)
Attack VectorNetwork
Attack ComplexityHigh
Attack RequirementsPresent
Privileges RequiredNone
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)High
Availability (Vulnerable System)None
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
CVSS v3.1 Base Metrics — Score 7.4 (HIGH)
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
Affected & Patched Versions
- MongoDB MongoDB Server >= 9.0.0 and < 9.0.7
- MongoDB MongoDB Server >= 8.3.0 and < 8.3.16
- MongoDB MongoDB Server >= 8.0.0 and < 8.0.37
- MongoDB MongoDB Server >= 7.0.0 and < 7.0.48
- MongoDB MongoDB Server 9.0.7
- MongoDB MongoDB Server 8.3.16
- MongoDB MongoDB Server 8.0.37
- MongoDB MongoDB Server 7.0.48