CVE-2026-13067: MongoDB X.509 Auth Bypass Vulnerability

CVE-2026-13067 Overview

CVE-2026-13067 is an authorization flaw in MongoDB that surfaces when the PROXY protocol v2 is used on a Unix domain socket path. Roles derived from X.509 client certificates during MONGODB-X509 authentication may bypass validation against the configured tlsCATrusts allow-list. The result is unintended role assignments granting privileges that should not be authorized for the presenting certificate.

Exploitation requires local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority. The weakness is tracked as CWE-863: Incorrect Authorization.

Critical Impact
A local attacker with a trusted X.509 certificate can obtain roles outside the tlsCATrusts allow-list, gaining elevated access to MongoDB data and administrative functions.

Affected Products

MongoDB Server configurations using PROXY protocol v2 over Unix domain sockets
Deployments relying on MONGODB-X509 authentication
Environments enforcing role restrictions via the tlsCATrusts configuration option

Discovery Timeline

2026-07-22 - CVE-2026-13067 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13067

Vulnerability Analysis

MongoDB supports the MONGODB-X509 authentication mechanism, allowing clients to authenticate using X.509 certificates. The tlsCATrusts option constrains which certificate authorities may issue certificates for specific roles, providing an allow-list that restricts privilege assignment.

When PROXY protocol v2 is enabled on a Unix domain socket path, the server accepts an additional header describing the original client connection. In this code path, MongoDB does not enforce tlsCATrusts validation against the roles derived from the client certificate. Roles that would otherwise be rejected by the allow-list are accepted, and the authenticated session receives privileges it should not hold.

The defect is a broken authorization check rather than an authentication failure. The certificate itself remains valid and trusted, but the mapping between certificate attributes and authorized roles is not filtered as configured.

Root Cause

The root cause is an incomplete authorization control [CWE-863] in the PROXY protocol v2 handling logic for Unix domain sockets. The code path that establishes the authenticated session skips the tlsCATrusts enforcement step that is applied on conventional TLS connections. Role assignment therefore proceeds using only the certificate subject and issuer, without cross-checking whether that issuer is permitted to grant the requested roles.

Attack Vector

An attacker requires two conditions: local access to the MongoDB proxy Unix domain socket and possession of a valid X.509 certificate signed by any CA trusted by the server. The attacker crafts a PROXY protocol v2 header, connects to the socket, and initiates MONGODB-X509 authentication. Because tlsCATrusts is not evaluated, the server assigns roles embedded in or associated with the certificate. The attacker then executes MongoDB operations under those elevated roles.

Refer to the MongoDB Server Issue Tracker (SERVER-128387) for technical details from the vendor.

Detection Methods for CVE-2026-13067

Indicators of Compromise

Successful MONGODB-X509 authentication events over Unix domain sockets where the client certificate issuer is not present in the configured tlsCATrusts allow-list.
Role assignments in audit logs that do not match the expected mapping for the authenticating certificate subject.
Unexpected administrative operations executed by service accounts shortly after PROXY protocol connections.

Detection Strategies

Enable MongoDB auditing and monitor authenticate and authCheck events for MONGODB-X509 sessions originating from Unix domain sockets.
Correlate certificate issuer distinguished names against the tlsCATrusts configuration to identify authorizations that would have been denied under proper enforcement.
Review process and socket access logs on the MongoDB host for local processes connecting to the proxy socket path.

Monitoring Recommendations

Alert on any new local user or process establishing a connection to the MongoDB PROXY-enabled Unix domain socket.
Track privileged operations such as createUser, grantRolesToUser, or dropDatabase performed by X.509-authenticated sessions.
Baseline expected certificate issuers and generate alerts when authentications occur from outliers.

How to Mitigate CVE-2026-13067

Immediate Actions Required

Disable PROXY protocol v2 on Unix domain socket paths until a patched MongoDB release is deployed.
Restrict filesystem permissions on the proxy Unix domain socket so that only trusted service accounts can connect.
Rotate and audit X.509 certificates issued by CAs configured in tlsCATrusts to confirm no unauthorized certificates exist.

Patch Information

Consult the MongoDB Server Issue Tracker (SERVER-128387) for fixed version information and upgrade guidance from MongoDB. Apply the vendor-supplied update that restores tlsCATrusts enforcement across all authentication paths, including PROXY protocol v2 on Unix domain sockets.

Workarounds

Remove PROXY protocol v2 configuration from Unix domain socket listeners and route trusted proxies through TCP listeners where tlsCATrusts is enforced.
Tighten host-level access controls so only vetted local accounts can reach the socket path.
Reduce the CA trust store to the minimum set of issuers required, limiting the scope of certificates that could be abused.

bash

# Configuration example: disable PROXY protocol on the Unix domain socket
# and restrict socket filesystem permissions
net:
  unixDomainSocket:
    enabled: true
    pathPrefix: /var/run/mongodb
    filePermissions: 0700
  # Remove or comment out any proxyProtocolVersion: 2 setting on the UDS listener