Read the docs
TI-2021-03623 Aliases CVE-2021-20335GHSA-4hh4-3rxm-gq3h

SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager

Priority LOW 29CWE-319Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. This issue is temporary and eventually corrects itself after MongoDB Ops Manager instances have finished upgrading to MongoDB Ops Manager 4.4. In addition, customers must be running with clientCertificateMode=OPTIONAL / allowConnectionsWithoutCertificates=true to be impacted*.* Customers upgrading from Ops Manager 4.2.X to 4.2.24 and finally to Ops Manager 4.4.13+ are unaffected by this issue.

Why it matters now

EPSS 0.0014 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBMongoDB Ops Manager4.2 – 4.2.24—No fix listedCNA
  • MongoDB Ops Manager VendorMongoDB Affected 4.2 – 4.2.24 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:ops_manager:*:*:*:*:*:*:*:*4.2.0 – 4.2.24VulnerableMongoDB
  • cpe:2.3:a:mongodb:ops_manager:*:*:*:*:*:*:*:* Versions 4.2.0 – 4.2.24 Vulnerable ·MongoDB

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-20335
  2. 2026-10-03 Alias added: GHSA-4hh4-3rxm-gq3h

References

Advisory 1

  • TI-2026-07412 Ops Manager RCE via webhook body CVSS 4.0CRITICAL 9.4
  • TI-2020-06410 Potential privilege escalation in Ops Manager API CVSS 3.1HIGH 8.1
  • TI-2026-69857 Uncontrolled resource consumption in MongoDB Ops Manager monitoring endpoints CVSS 4.0MEDIUM 6.9
  • TI-2019-01948 Potential exposure of log information in Ops Manager CVSS 3.1MEDIUM 5.8
  • TI-2026-69856 MongoDB Ops Manager exposes pending MFA enrollment seeds in user listings CVSS 4.0MEDIUM 6.0
  • TI-2026-69855 Improper authorization in MongoDB Ops Manager host monitoring retrieval CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences