CVE-2026-8431

critical · 9.4

An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.

9.4

CVSS

0.4%

EPSS (exploit prob.)

31st

EPSS percentile

2026-05-12

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-77

References

https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-8.0.23

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-8431