Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

MongoDB Kubernetes Operator lets config changes alter Ops Manager

CVE-2026-103546 · published 13 days ago
Summary

The MongoDB controller for Kubernetes does not fully check backup settings when a user edits the Ops Manager configuration. This can let someone with permission to change that configuration unintentionally modify administrative settings in Ops Manager, potentially disrupting backups. Review and tighten who can edit the Ops Manager custom resource, and apply the latest updates that add proper validation.

What to do
  • Update mongodb, inc. mongodb controllers for kubernetes to version 1.13.0 or later.
Affected software
VendorProductAffected versions
mongodb, inc. mongodb controllers for kubernetes < 1.13.0
Original advisory text
Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator
In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published5 Oct 2026
Updated15 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-103546 · NVD
CVE-2026-103546 · MITRE
CVE-2026-103546 · OSV
Track software like this
Free during beta