CVE-2026-81518

Name of the Vulnerable Software and Affected Versions mongosqld (affected versions not specified)

Description When configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one. This allows clients that provide no certificate to be accepted. In environments where client certificates are the only method for user identification, a remote party with network access to the listener can establish a session and read MongoDB data exposed through the connector.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.