CVE-2026-13067

Name of the Vulnerable Software and Affected Versions MongoDB (affected versions not specified)

Description When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This failure in validation can lead to unintended role assignments after MONGODB-X509 authentication. Exploitation requires local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.