Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
MongoDB permits wildcard certificates despite subdomain exclusions
published 9 months ago
Summary
MongoDB can accept a certificate that includes a wildcard name even when the certificate chain tries to block certain sub‑domains. This means an attacker could present a seemingly trusted certificate and intercept or impersonate services. Update MongoDB to the latest version or apply the vendor’s recommended configuration changes to enforce proper certificate restrictions.
What to do
- Update cleanstart mongodb to version 8.2.1-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | mongodb |
< 8.2.1-r1 Fix: upgrade to 8.2.1-r1
|
Original advisory text
excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate
Multiple security vulnerabilities affect the mongodb package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details.
References
- https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advis... Vendor Advisory
- https://osv.dev/vulnerability/CVE-2025-14847 URL
- https://osv.dev/vulnerability/CVE-2025-58181 URL
- https://osv.dev/vulnerability/CVE-2025-61727 URL
- https://nvd.nist.gov/vuln/detail/CVE-2025-14847 URL
- https://nvd.nist.gov/vuln/detail/CVE-2025-58181 URL
- https://nvd.nist.gov/vuln/detail/CVE-2025-61727 URL
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published30 Jan 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-RN77098 · OSV
Track software like this
Free during beta