CVE-2026-120808
Certificate Validation Bypass via IPv6 trust-result skip in macOS TLS client
An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connections to IPv6-addressed peers. When a MongoDB process using the Apple SecureTransport TLS backend connects to an IPv6 target, the trust evaluation result from SecTrustEvaluate is silently discarded, regardless of whether the peer's certificate is trusted. An on-path party could exploit this by presenting a self-signed certificate containing the target's IPv6 address in the Subject Alternative Name to intercept and modify encrypted inter-node or external service traffic. This issue only affects MongoDB processes running on macOS with the Apple SecureTransport TLS provider.
| CWE | CWE-295 |
| Vendor | mongodb |
| Product | mongodb server |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 10, 2026 |
Get instant alerts for mongodb mongodb server
Be the first to know when new high vulnerabilities affecting mongodb mongodb server are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N