Certificate validation issue in MongoDB Server running on Windows or macOS
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-295.
Summary
If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate. This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MongoDB | MongoDB Server | 6.3 – 6.3.2; 5.0 – 5.0.14; 4.4 – 4.4.23 | — | No fix listed | CNA |
- MongoDB Server VendorMongoDB Affected 6.3 – 6.3.2; 5.0 – 5.0.14; 4.4 – 4.4.23 Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* | 4.4.0 to before 4.4.23; 5.0.0 – 5.0.14; 6.0.0 to before 6.0.7; 6.3.0 – 6.3.2 | Vulnerable | MongoDB |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* Versions 4.4.0 to before 4.4.23; 5.0.0 – 5.0.14; 6.0.0 to before 6.0.7; 6.3.0 – 6.3.2 Vulnerable ·MongoDB
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-1409
- 2026-10-03 Alias added: GHSA-pjfq-h6gx-wrcf
References
More Mongodb vulnerabilities
- TI-2025-13542 Zlib compressed protocol header length confusion may allow memory read KEVCVSS 4.0HIGH 8.7
- TI-2013-01669 MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the… CVSS 2.0MEDIUM 6.0
- TI-2026-56639 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service CVSS 4.0HIGH 8.7
- TI-2026-56628 Reachable assertion in MongoDB Server CVSS 4.0HIGH 8.7
- TI-2026-15322 Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos CVSS 4.0HIGH 8.7
- TI-2026-08537 Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow CVSS 4.0HIGH 8.7
Sources
- CVE-2023-1409 · CVE Program
- CVE-2023-1409 · NVD
- FIRST EPSS
- GHSA-pjfq-h6gx-wrcf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences