Detections
Analytics

MongoDB 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-124355)

high Nessus Plugin ID 331216

Synopsis

The remote host is missing a security update.

Description

The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28 or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities:

 - Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error. (CVE-2026-13056)

 - When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. (CVE-2026-13067)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to MongoDB version 8.0.28 / 8.3.7 or later.

See Also

https://jira.mongodb.org/browse/SERVER-124355

Plugin Details

Severity: High

ID: 331216

File Name: mongodb_server_SERVER-124355.nasl

Version: 1.2

Type: Combined

Agent: windows, macosx, unix

Family: Databases

Published: 7/30/2026

Updated: 7/31/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.63

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-13056

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.5

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-13067

CVSS v4

Risk Factor: High

Base Score: 7.2

Threat Score: 4.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-13067

Vulnerability Information

CPE: cpe:/a:mongodb:mongodb

Required KB Items: installed_sw/MongoDB

Exploit Ease: No known exploits are available

Patch Publication Date: 7/22/2026

Vulnerability Publication Date: 7/22/2026

Reference Information

CVE: CVE-2026-13056, CVE-2026-13067