CVE-2026-13067
Low
No strong exploitation signal.
CVSS base
6.3
MEDIUM
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS — probability of exploitation (30 days)
0.1%
0.8th percentile
CISA KEV
Not listed
Weakness / dates
CWE-863
Published 2026-07-22 · modified 2026-08-05
CVSS breakdown
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
| Attack Vector | L | Local |
| Attack Complexity | H | High |
| Privileges Required | L | Low |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | H | High |
| Integrity | H | High |
| Availability | N | None |
Timeline
- 2026-07-22 — Published (NVD)
- 2026-08-05 — Last modified (NVD)
Description
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.