TI-2019-01947 Aliases CVE-2019-2386 GHSA-gqrr-9cvj-jrrq

Authorization session conflation

LOW 34CWE-285Published 2019-08-06 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-285.

Summary

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects MongoDB Server v4.0 versions prior to 4.0.9; MongoDB Server v3.6 versions prior to 3.6.13 and MongoDB Server v3.4 versions prior to 3.4.22. Workaround: After deleting one or more users, restart any nodes which may have had active user authorization sessions. Refrain from creating user accounts with the same name as previously deleted accounts.

Why it matters now

EPSS 0.01136 66th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial MongoDB Server (MongoDB Inc.): 4.0.9, 3.6.13, 3.4.22Red Hat: 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MongoDB	MongoDB Server	4.0 to before 4.0.9; 3.6 to before 3.6.13; 3.4 to before 3.4.22	4.0.9, 3.6.13, 3.4.22	Patch available	CNA

MongoDB Server VendorMongoDB Affected 4.0 to before 4.0.9; 3.6 to before 3.6.13; 3.4 to before 3.4.22 Fixed in 4.0.9, 3.6.13, 3.4.22 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mongodb:mongodb::::::::	3.4.0 to before 3.4.22; 3.6.0 to before 3.6.13; 4.0.0 to before 4.0.9	Vulnerable	MongoDB

cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* Versions 3.4.0 to before 3.4.22; 3.6.0 to before 3.6.13; 4.0.0 to before 4.0.9 Vulnerable ·MongoDB

Remediation

Fix · CNA MongoDB Server (MongoDB Inc.) Fixed in 4.0.9, 3.6.13, 3.4.22

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenStack Platform 10 (Newton)	Affected	No fix planned: Will not fix
Red Hat Software Collections	Affected	No fix planned: Will not fix
Red Hat Update Infrastructure 3 for Cloud Providers	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2019-2386
2026-10-03 Alias added: GHSA-gqrr-9cvj-jrrq

References

Exploit 1

https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0829

Advisory 1

https://jira.mongodb.org/browse/SERVER-38984

TI-2025-13542 Zlib compressed protocol header length confusion may allow memory read KEVCVSS 4.0HIGH 8.7
TI-2013-01669 MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the… CVSS 2.0MEDIUM 6.0
TI-2026-56639 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service CVSS 4.0HIGH 8.7
TI-2026-56628 Reachable assertion in MongoDB Server CVSS 4.0HIGH 8.7
TI-2026-15322 Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos CVSS 4.0HIGH 8.7
TI-2026-08537 Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow CVSS 4.0HIGH 8.7

See all 187 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences