CVE-2025-10491: MongoDB Server Privilege Escalation Flaw

CVE-2025-10491 Overview

CVE-2025-10491 is a local privilege escalation vulnerability affecting the MongoDB Server Windows installer. The MongoDB MSI installer fails to apply Access Control Lists (ACLs) when the operator selects a custom installation directory. This oversight allows a local attacker with write access to that directory to plant a malicious Dynamic Link Library (DLL) that the MongoDB service process loads at runtime. The result is arbitrary code execution in the security context of the MongoDB service. The issue affects MongoDB Server v6.0 prior to 6.0.25, v7.0 prior to 7.0.21, and v8.0 prior to 8.0.5.

Critical Impact
A local attacker can achieve code execution in the MongoDB service context through DLL hijacking, compromising database confidentiality, integrity, and availability.

Affected Products

MongoDB Server v6.0 versions prior to 6.0.25 (Windows MSI installations)
MongoDB Server v7.0 versions prior to 7.0.21 (Windows MSI installations)
MongoDB Server v8.0 versions prior to 8.0.5 (Windows MSI installations)

Discovery Timeline

2025-09-15 - CVE-2025-10491 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10491

Vulnerability Analysis

The vulnerability is classified under [CWE-284] Improper Access Control. The MongoDB Windows MSI installer applies restrictive ACLs to its default installation path but omits this step when an administrator specifies a custom directory. As a result, the installation directory inherits permissions from its parent, which may grant write access to standard users or the Authenticated Users group.

The MongoDB service runs from this directory and loads dependent DLLs at process start. When Windows resolves DLL names, it searches the executable's directory first. An attacker who writes a malicious DLL matching an expected library name will have that DLL loaded into mongod.exe. The service typically runs under NT AUTHORITY\SYSTEM or a dedicated service account, giving the injected code elevated privileges.

Root Cause

The root cause is a missing security step in the MSI installation logic. The installer does not enforce hardened ACLs on operator-supplied installation paths, leaving directory permissions dependent on parent inheritance. Standard Windows filesystem inheritance frequently permits non-administrative users to create files in subdirectories under paths outside C:\Program Files.

Attack Vector

Exploitation requires local access with low privileges. An attacker identifies a MongoDB installation placed in a custom directory with weak ACLs. The attacker writes a malicious DLL using the name of a library that mongod.exe loads. When the MongoDB service starts or restarts, the process loads the attacker-controlled DLL and executes the payload with service-level privileges. No user interaction is required. Details are tracked in the MongoDB Server Bug Tracker SERVER-51366.

Detection Methods for CVE-2025-10491

Indicators of Compromise

Unexpected DLL files in the MongoDB installation directory that do not match the vendor manifest or file hashes
mongod.exe process loading DLLs from paths outside C:\Windows\System32 or the signed MongoDB binary set
New child processes spawned by mongod.exe that are inconsistent with normal database operation
Recent file writes to the MongoDB installation directory performed by non-administrative accounts

Detection Strategies

Enumerate installed MongoDB directories and audit ACLs for entries granting write access to non-administrative principals
Compare loaded modules of mongod.exe against the vendor-shipped file list using Sysinternals listdlls or equivalent
Alert on Windows Event ID 4663 (file access) for write operations to MongoDB directories by non-service accounts
Monitor service start events (Event ID 7036) correlated with recent DLL file creation in the service's working directory

Monitoring Recommendations

Enable object access auditing on all MongoDB installation directories, especially non-default paths
Ingest Sysmon Event ID 7 (Image Loaded) telemetry to detect unsigned or anomalous DLLs loading into mongod.exe
Baseline the expected DLL load set for each MongoDB version and alert on deviations

How to Mitigate CVE-2025-10491

Immediate Actions Required

Upgrade MongoDB Server to 6.0.25, 7.0.21, 8.0.5, or later on all affected Windows hosts
Audit ACLs on every MongoDB installation directory and remove write permissions for non-administrative users
Restart the MongoDB service after remediation to ensure only legitimate DLLs are loaded
Inventory all custom installation paths used across the environment and prioritize those under user-writable locations

Patch Information

MongoDB has addressed the issue in MongoDB Server versions 6.0.25, 7.0.21, and 8.0.5. Refer to the MongoDB Server Bug Tracker SERVER-51366 for the vendor advisory and full remediation details. Reinstallation or repair with the patched MSI applies the correct ACLs to the installation directory.

Workarounds

Manually apply restrictive ACLs on the MongoDB installation directory, granting write access only to Administrators and SYSTEM
Install MongoDB to the default path under C:\Program Files\, which inherits protected permissions
Run the MongoDB service under a dedicated least-privilege service account to limit the impact of successful DLL hijacking

bash

# Restrict ACLs on a custom MongoDB installation directory using icacls
icacls "D:\Apps\MongoDB" /inheritance:r
icacls "D:\Apps\MongoDB" /grant:r "Administrators:(OI)(CI)F"
icacls "D:\Apps\MongoDB" /grant:r "SYSTEM:(OI)(CI)F"
icacls "D:\Apps\MongoDB" /grant:r "NT SERVICE\MongoDB:(OI)(CI)RX"