CVE-2026-82053
Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control configuration, potentially allowing an authenticated user to acquire elevated privileges that were not intended by the deployment's authorization policy.
| CWE | CWE-863 |
| Vendor | mongodb |
| Product | mongodb server |
| Ecosystems | |
| Industries | Technology |
| Published | Sep 8, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for mongodb mongodb server
Be the first to know when new high vulnerabilities affecting mongodb mongodb server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
MongoDB / MongoDB Server
8.3.0 < 8.3.9 8.0.0 < 8.0.30 7.0.0 < 7.0.41