Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-87108: MongoDB Ops Manager can expose other project host data

CVE-2026-87108 · published 10 days ago

Summary

A user who can only view projects in Ops Manager can still pull daily host monitoring information from a different project if they know the record ID. This may reveal details about servers and configurations that should be private. Make sure access controls verify project ownership before returning such data, and apply patches or configuration changes that enforce proper checks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
mongodb	ops manager	<= 7.0.23
mongodb	ops_manager	>= 7.0.0, < 7.0.23 >= 8.0.0, < 8.0.27 `cpe:2.3:a:mongodb:ops_manager::::::::`

Original advisory text

Ops Manager Improper Authorization in Daily Host Monitoring Retrieval

An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.

References

https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#ops-... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.3 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-639Authorization Bypass Through User-Controlled Key

Timeline

Published9 Oct 2026

Updated18 Oct 2026

First seen9 Oct 2026

Sources

CVE-2026-87108 · NVD

CVE-2026-87108 · MITRE

Track software like this

Free during beta