Read the docs
TI-2026-07412 Aliases CVE-2026-8431GHSA-6m5j-p732-cfhq

Ops Manager RCE via webhook body

Priority MEDIUM 43CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.  This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00371 31st percentileScored 2026-11-07
Fix Fixed Ops Manager (MongoDB, Inc.): 8.0.23

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBOps Manager7.0 to before 8.0.238.0.23Patch availableCNA
  • Ops Manager VendorMongoDB Affected 7.0 to before 8.0.23 Fixed in 8.0.23 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:ops_manager:*:*:*:*:*:*:*:*7.0.0 to before 8.0.23VulnerableMongoDB
  • cpe:2.3:a:mongodb:ops_manager:*:*:*:*:*:*:*:* Versions 7.0.0 to before 8.0.23 Vulnerable ·MongoDB

Remediation

  • Fix · CNA Ops Manager (MongoDB, Inc.) Fixed in 8.0.23

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8431
  2. 2026-10-03 Alias added: GHSA-6m5j-p732-cfhq
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

  • TI-2020-06410 Potential privilege escalation in Ops Manager API CVSS 3.1HIGH 8.1
  • TI-2026-69857 Uncontrolled resource consumption in MongoDB Ops Manager monitoring endpoints CVSS 4.0MEDIUM 6.9
  • TI-2021-03623 SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager CVSS 3.1MEDIUM 6.7
  • TI-2019-01948 Potential exposure of log information in Ops Manager CVSS 3.1MEDIUM 5.8
  • TI-2026-69856 MongoDB Ops Manager exposes pending MFA enrollment seeds in user listings CVSS 4.0MEDIUM 6.0
  • TI-2026-69855 Improper authorization in MongoDB Ops Manager host monitoring retrieval CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences