Ops Manager RCE via webhook body_CVE-2026-8431

9.4 / 10

CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Description

An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.

This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.

Basic Information

ID CVE-2026-8431

Source mongodb

Published May 12, 2026 at 18:37

Affected Product

Vendor MongoDB, Inc.

Product Ops Manager

Version 7.0

Affected Versions MongoDB, Inc. Ops Manager 7.0

CWE Classification

CWE-77

References

www.mongodb.com /docs/ops-manager/current/release-notes/application/

{
    "lastseen": "",
    "description": "An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.\u00a0\n\n\n\nThis issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.",
    "published": "2026-05-12T18:37:47.687Z",
    "modified": "2026-05-12T18:37:47.687Z",
    "type": "cve",
    "title": "Ops Manager RCE via webhook body",
    "source": "mongodb",
    "references": "https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-8.0.23",
    "id": "CVE-2026-8431",
    "bulletinFamily": "",
    "cwe": [
        "CWE-77"
    ],
    "cvelist": null,
    "sourceData": "MongoDB, Inc. Ops Manager 7.0",
    "sourceHref": "",
    "cvss": {
        "score": 9.4,
        "severity": "CRITICAL",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Ops Manager",
    "version": "7.0",
    "vendor": "MongoDB, Inc.",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}