Read the docs
TI-2020-06410 Aliases CVE-2020-7927GHSA-8v6g-rf54-42cg

Potential privilege escalation in Ops Manager API

Priority LOW 37CWE-648Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 and MongoDB Ops Manager v4.4 versions prior to and including 4.4.2.

Why it matters now

EPSS 0.01044 64th percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBMongoDB Ops Manager4.2 – 4.2.17; 4.3 – 4.3.9; 4.4 – 4.4.2—No fix listedCNA
  • MongoDB Ops Manager VendorMongoDB Affected 4.2 – 4.2.17; 4.3 – 4.3.9; 4.4 – 4.4.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:ops_manager:*:*:*:*:*:*:*:*4.2.0 – 4.2.17; 4.3.0 – 4.3.9; 4.4.0 – 4.4.2VulnerableMongoDB
  • cpe:2.3:a:mongodb:ops_manager:*:*:*:*:*:*:*:* Versions 4.2.0 – 4.2.17; 4.3.0 – 4.3.9; 4.4.0 – 4.4.2 Vulnerable ·MongoDB

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Not affected: 3 products
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Software Collections
  • Red Hat Update Infrastructure 3 for Cloud Providers

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7927
  2. 2026-10-03 Alias added: GHSA-8v6g-rf54-42cg

References

Other 1

  • TI-2026-07412 Ops Manager RCE via webhook body CVSS 4.0CRITICAL 9.4
  • TI-2026-69857 Uncontrolled resource consumption in MongoDB Ops Manager monitoring endpoints CVSS 4.0MEDIUM 6.9
  • TI-2021-03623 SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager CVSS 3.1MEDIUM 6.7
  • TI-2019-01948 Potential exposure of log information in Ops Manager CVSS 3.1MEDIUM 5.8
  • TI-2026-69856 MongoDB Ops Manager exposes pending MFA enrollment seeds in user listings CVSS 4.0MEDIUM 6.0
  • TI-2026-69855 Improper authorization in MongoDB Ops Manager host monitoring retrieval CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences