CVE-2026-8431

An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-8.0.23	Vendor Advisory Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:mongodb:ops_manager:*:*:*:*:*:*:*:*

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Un usuario administrativo con acceso para configurar webhooks puede ejecutar comandos arbitrarios configurando y luego activando webhooks que contienen sintaxis de plantilla FreeMarker específica. Este problema afecta a todas las versiones de MongoDB Ops Manager 7.0 y a las versiones de MongoDB Ops Manager 8.0.22 y anteriores.

24 Sep 2026, 17:34

Type	Values Removed	Values Added
First Time		Mongodb Mongodb ops Manager
References	~~() https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-8.0.23 -~~	() https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-8.0.23 - Vendor Advisory, Release Notes
CPE		cpe:2.3:a:mongodb:ops_manager::::::::

Information

Published : 2026-05-12 19:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-8431

Mitre link : CVE-2026-8431

CVE.ORG link : CVE-2026-8431

JSON object : View

Products Affected

mongodb

ops_manager

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2026-8431", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8431", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-12T20:24:22.599314Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@mongodb.com", "affectedData": [{"vendor": "MongoDB, Inc.", "product": "Ops Manager", "versions": [{"status": "affected", "version": "7.0", "lessThan": "8.0.23", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-12T19:16:34.847", "references": [{"url": "https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-8.0.23", "tags": ["Vendor Advisory", "Release Notes"], "source": "cna@mongodb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@mongodb.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.\u00a0\n\n\n\nThis issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior."}, {"lang": "es", "value": "Un usuario administrativo con acceso para configurar webhooks puede ejecutar comandos arbitrarios configurando y luego activando webhooks que contienen sintaxis de plantilla FreeMarker espec\u00edfica.\n\nEste problema afecta a todas las versiones de MongoDB Ops Manager 7.0 y a las versiones de MongoDB Ops Manager 8.0.22 y anteriores."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:ops_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40B4DD25-FF68-4EAA-A038-22927E035D03", "versionEndExcluding": "8.0.23", "versionStartIncluding": "7.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@mongodb.com"}