CVE-2021-20335

CVE-2021-20335 affects MongoDB Ops Manager versions up to 4.2.24 and up to 4.4.12 when SSL is enabled for MongoDB processes; during upgrade, Automation may temporarily disable SSL on cluster members due to a bug, until upgrades complete. Impact requires clientCertificateMode=OPTIONAL or allowConn...

CVE-2020-7927

CVE-2020-7927 affects MongoDB Ops Manager; a specially crafted API call can let an authenticated user with Organization Owner privilege obtain an API key with Global Role privilege. Affected releases include Ops Manager v4.2.x up to 4.2.17, v4.3.x up to 4.3.9, and v4.4.x up to 4.4.2. The issue is...

CVE-2019-2388

CVE-2019-2388 corresponds to an information-disclosure issue in MongoDB Ops Manager. Affected versions: MongoDB Ops Manager 4.0.9–4.0.10 and 4.1.5. The root cause is an exposed HTTP route that can allow an attacker to view a specific access log from a publicly exposed Ops Manager instance. Impact...

CVE-2026-8431

MongoDB Ops Manager versions affected: 7.0 and 8.0.22 and earlier. The vulnerability arises from the Webhook feature: an administrative user who can configure webhooks can trigger arbitrary commands by including specific FreeMarker template syntax in webhook payloads. This is a remote-network, hi...

CVE-2026-87109

An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed via user-listing endpoints. This vulnerability occurs specifically while a member's enrollment remains unconfirmed, leading to the disclosure of secret authentication material to o...

CVE-2026-87110

The Ops Manager web port is susceptible to uncontrolled resource consumption (CWE-770). An unauthenticated user with network access can repeatedly request specific monitoring endpoints that perform costly operations. Because these endpoints lack rate limiting , the attack can temporarily slow dow...

CVE-2026-87108

The MongoDB Ops Manager is vulnerable to an improper authorization flaw where an authenticated user with a read-only project role can retrieve daily host monitoring records from different projects. By providing a specific record identifier, the attacker can bypass ownership validation to access s...