MongoDB Ops Manager Authenticated Member Disclosure of Authenticator Seed
CVE-2026-87109 Published on October 9, 2026
Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
Vulnerability Analysis
CVE-2026-87109 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. Sensitive information could include data that is sensitive in and of itself (such as credentials or private messages), or otherwise useful in the further exploitation of the system (such as internal file system structure).
Products Associated with CVE-2026-87109
Want to know whenever a new CVE is published for MongoDB Ops Manager? stack.watch will email you.
Affected Versions
MongoDB Ops Manager:- Version 7.0.0, <= 7.0.23 is affected.
- Version 8.0.0 and below 8.0.27 is affected.