Vulnerability details

CVE-2026-8431

MongoDB Ops Manager

Ops Manager RCE via webhook body

CVSS 4.0

9.4Critical

Official description

An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.

CVSS scores

Score	Version	Source	Vector
9.4Critical	4.0	CVEProject cvelistV5 (CNA) (mongodb)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
7.2High	3.1	CVEProject cvelistV5 (CNA) (mongodb)	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
MongoDB, Inc.	Ops Manager	7.0 ≤ v < 8.0.23	CVEProject cvelistV5 (CNA)

References and advisories

https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-8.0.23 release-notes

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-05-12
Last updated: 2026-05-12
State: Published
Assigner (CNA): mongodb

Exploit prediction (EPSS)

0.37%

Probability of exploitation in 30 days

31.2%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')