CVE-2026-120808

Name of the Vulnerable Software and Affected Versions MongoDB versions prior to 7.0.48 MongoDB versions prior to 8.0.37 MongoDB versions prior to 8.3.16 MongoDB versions prior to 9.0.7

Description An issue in the macOS TLS client implementation occurs when using the Apple SecureTransport TLS backend for outbound connections to IPv6-addressed peers. The trust evaluation result from the SecTrustEvaluate() function is silently discarded, allowing the certificate chain-of-trust validation to be bypassed regardless of whether the peer's certificate is trusted. An on-path attacker could exploit this by presenting a self-signed certificate containing the target's IPv6 address in the Subject Alternative Name to intercept and modify encrypted inter-node or external service traffic.

Recommendations Update to version 7.0.48. Update to version 8.0.37. Update to version 8.3.16. Update to version 9.0.7.