CVE-2026-103546: MongoDB Kubernetes Privilege Escalation

CVE-2026-103546 Overview

CVE-2026-103546 affects MongoDB Controllers for Kubernetes. Insufficient validation of Ops Manager backup configuration allows a user with permission to modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. The flaw impacts deployments using Enterprise Ops Manager backup reconciliation. The vulnerability is mapped to [CWE-918] Server-Side Request Forgery (SSRF).

Critical Impact
An authenticated Kubernetes user with rights to edit the OpsManager custom resource can trigger administrative changes in Ops Manager through improperly validated backup configuration fields.

Affected Products

MongoDB Controllers for Kubernetes (versions prior to 1.13.0)
MongoDB Enterprise Ops Manager deployments relying on backup reconciliation
Kubernetes clusters running the MongoDB Enterprise Kubernetes Operator

Discovery Timeline

2026-10-05 - CVE-2026-103546 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-103546

Vulnerability Analysis

The MongoDB Enterprise Kubernetes Operator reconciles OpsManager custom resources into Ops Manager configuration. During reconciliation of backup settings, the controller does not sufficiently validate user-supplied values before passing them to Ops Manager administrative APIs. A tenant or namespace user with permission to modify an OpsManager custom resource can inject configuration data that the controller treats as trusted.

Because the controller runs with privileged access to Ops Manager, these unvalidated inputs translate into administrative changes the submitting user could not otherwise make directly. The CWE-918 mapping indicates server-side request behavior where the controller issues outbound requests on behalf of the user without constraining targets or payloads.

Root Cause

The root cause is missing or insufficient input validation on backup configuration fields within the OpsManager custom resource reconciliation path. The controller trusts data embedded in the custom resource and forwards it to Ops Manager without authorization checks against the submitting user's effective privileges.

Attack Vector

Exploitation requires an authenticated Kubernetes user with permission to create or modify OpsManager custom resources in the operator's watched namespaces. The attacker crafts backup configuration fields that cause the operator, during the next reconciliation cycle, to invoke Ops Manager administrative operations the user is not entitled to perform. No end-user interaction is required and the attack is delivered over the network to the Kubernetes API server.

No public proof-of-concept exploit is available. See the MongoDB Kubernetes Release 1.13.0 notes for the technical fix.

Detection Methods for CVE-2026-103546

Indicators of Compromise

Unexpected modifications to OpsManager custom resources, especially within spec.backup fields, from accounts that do not routinely manage Ops Manager.
Ops Manager administrative changes (backup daemon settings, S3 or blockstore configuration, project assignments) that do not correlate with authorized change tickets.
Operator pod logs showing reconciliation errors or warnings tied to backup configuration validation.

Detection Strategies

Audit Kubernetes API server logs for update, patch, and create verbs on the opsmanagers.mongodb.com resource and correlate with the acting ServiceAccount or user.
Compare current OpsManager resource manifests against Git-stored baselines to flag drift in backup configuration fields.
Review Ops Manager audit logs for administrative API calls originating from the operator service account outside expected reconciliation windows.

Monitoring Recommendations

Forward Kubernetes audit logs and Ops Manager audit events into a centralized analytics platform for correlation of operator activity with downstream administrative changes.
Alert on any change to OpsManager custom resources performed by principals outside a defined allowlist of platform administrators.
Track MongoDB Enterprise Kubernetes Operator version across clusters and alert when any instance remains below 1.13.0.

How to Mitigate CVE-2026-103546

Immediate Actions Required

Upgrade MongoDB Controllers for Kubernetes to version 1.13.0 or later in all clusters that run the MongoDB Enterprise Kubernetes Operator.
Restrict RBAC permissions on opsmanagers.mongodb.com custom resources to a minimal set of trusted platform administrators.
Review recent changes to OpsManager resources and corresponding Ops Manager administrative state for unauthorized modifications.

Patch Information

MongoDB addressed the issue in the MongoDB Kubernetes Operator 1.13.0 release. Deployment details and changelog are available in the MongoDB Kubernetes Release 1.13.0 notes.

Workarounds

Apply Kubernetes RBAC Role and RoleBinding policies that deny update and patch on OpsManager resources for non-administrative users and service accounts.
Enforce admission control (OPA Gatekeeper or Kyverno) policies that validate spec.backup fields in OpsManager resources before they are persisted.
Isolate the MongoDB operator in a dedicated namespace with network policies limiting access to the Ops Manager administrative endpoints.

bash

# Example Kyverno policy snippet: restrict who can modify OpsManager backup config
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-opsmanager-backup-edits
spec:
  validationFailureAction: Enforce
  rules:
    - name: only-platform-admins-can-edit-backup
      match:
        any:
          - resources:
              kinds:
                - OpsManager
      exclude:
        any:
          - subjects:
              - kind: Group
                name: platform-admins
      validate:
        message: "Only platform-admins may modify OpsManager backup configuration."
        deny:
          conditions:
            any:
              - key: "{{ request.object.spec.backup }}"
                operator: NotEquals
                value: "{{ request.oldObject.spec.backup }}"