PT-2025-47988 · Mongodb · Mongodb Server+1

Published 2025-11-25 · Updated 2025-12-06 · CVE-2025-12893

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 7.0.26 MongoDB Server versions prior to 8.0.16 MongoDB Server versions prior to 8.2.2

Description A MongoDB server may incorrectly establish TLS handshakes with clients or servers presenting certificates that do not meet the documented Extended Key Usage (EKU) requirements. Specifically, a client certificate lacking extendedKeyUsage = clientAuth may be accepted, and a server certificate missing extendedKeyUsage = serverAuth may also be successfully authenticated. This behavior is observed on Windows and Apple systems for client certificates, and on Apple systems for server certificates, as validation functions correctly on Linux.

Recommendations Update MongoDB Server to version 7.0.26 or later. Update MongoDB Server to version 8.0.16 or later. Update MongoDB Server to version 8.2.2 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BIT-MONGODB-2025-12893

CVE-2025-12893

Affected Products

Mongodb Server

Mongodb

References · 11

• https://jira.mongodb.org/browse/SERVER-105783 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12893 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-12893 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-12893 · Security Note
• https://osv.dev/vulnerability/BIT-mongodb-2025-12893 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12893 · Security Note
• https://ubuntu.com/security/CVE-2025-12893 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12893 · Note
• https://t.me/cveNotify/143899 · Telegram Post
• https://twitter.com/CVEnew/status/1993187158996164712 · Twitter Post
• https://t.me/CVEtracker/38154 · Telegram Post