CVE-2026-82053

MongoDB's LDAP authorization integration contains an incorrect-authorization flaw (CWE-863) in which pooled LDAP connections can retain a stale authentication identity after a user authenticates, under certain configurations. When this occurs, subsequent authorization queries execute under the unintended LDAP identity, and the LDAP directory's access control configuration can then yield role assignments that differ from the deployment's intended authorization policy. An authenticated user could consequently acquire privileges beyond what the policy intended, effectively a privilege escalation. Affected are MongoDB deployments that use the LDAP authorization integration with connection pooling under the impacted configurations (no specific affected version range was provided in the available data). No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Upgrade MongoDB Server to the patched release cited in MongoDB's advisory for CVE-2026-82053 once available (no fixed version is given in the current data). Meanwhile, audit deployments that use LDAP authorization with connection pooling, reviewing users' effective roles for unintended privilege grants and considering a restart of mongod instances or adjustments to LDAP connection pooling to clear stale identities. Verify that the LDAP directory's access control configuration matches the deployment's intended authorization policy.