MongoDB Server: Certificate validation bypass in macOS TLS client
Summary
MongoDB Server builds for macOS that use the Apple SecureTransport TLS provider discard the certificate trust result for outbound connections to IPv6 peers. An on-path attacker can present a self-signed certificate containing the target's IPv6 address and intercept or modify the encrypted traffic between MongoDB nodes or to external services. The default configuration is not affected, and the CVSS 9.1 score is not yet verified by NVD analysis.
Affected
- MongoDB Server 9.0.0 to before 9.0.7
- MongoDB Server 8.3.0 to before 8.3.16
- MongoDB Server 8.0.0 to before 8.0.37
- MongoDB Server 7.0.0 to before 7.0.48
- Relevant only on macOS with the Apple SecureTransport TLS provider and outbound connections to IPv6 addresses (per vendor CNA description; the default configuration is unaffected)
Fixed in
- 9.0.7
- 8.3.16
- 8.0.37
- 7.0.48
Workaround
Unknown.
Exploitation
Unknown. No reports of exploitation in the wild or public proof of concept were found at the time of writing.
Our recommendation
- Inventory macOS hosts running MongoDB, including developer machines and Mac minis.
- Upgrade to a fixed version (9.0.7, 8.3.16, 8.0.37 or 7.0.48 or later) once available in your environment.
- Until patched, avoid running MongoDB on macOS for traffic that crosses untrusted networks.
- Monitor the MongoDB alerts page and re-check NVD for the final severity assessment.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MongoDB Jira ticket SERVER-130681 jira.mongodb.org
- MongoDB security alerts www.mongodb.com
- MongoDB Security Transport Encryption documentation www.mongodb.com
- NVD: CVE-2024-1351 (similar earlier TLS certificate validation issue) nvd.nist.gov
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:24.
Original description (NVD)
An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connections to IPv6-addressed peers. When a MongoDB process using the Apple SecureTransport TLS backend connects to an IPv6 target, the trust evaluation result from SecTrustEvaluate is silently discarded, regardless of whether the peer's certificate is trusted. An on-path party could exploit this by presenting a self-signed certificate containing the target's IPv6 address in the Subject Alternative Name to intercept and modify encrypted inter-node or external service traffic. This issue only affects MongoDB processes running on macOS with the Apple SecureTransport TLS provider.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.