CVE-2026-82067

CVE-2026-82067 is a case-sensitivity flaw (CWE-178) in the configuration validation component of MongoDB Server: when a configuration value controlling authorization is handled case-sensitively during startup, the authorization subsystem can remain in its default disabled state. Affected deployments therefore start with authentication and authorization effectively not enforced. Any unauthenticated user with network access to the database listener can then perform arbitrary administrative operations, giving full impact on data confidentiality, integrity, and availability (read, modify, or destroy data). Only MongoDB Server deployments that hit this specific case-sensitivity condition are affected, and the source data does not specify affected or fixed version ranges. Exploitation has not been reported: there is no public proof of concept, the issue is not in CISA KEV, and EPSS estimates the 30-day exploitation probability at about 0.3% (21st percentile).

What to do: Verify on your mongod instances that authorization is actually enforced after every restart (test that unauthenticated connections are rejected, and monitor for anonymous administrative activity). Restrict network access to the database listener with firewalls or private networking so only trusted clients can reach it. Upgrade MongoDB Server to the patched release identified in MongoDB's security advisory once published; the source data does not name fixed version ranges.