PT-2026-40350 · Mongodb · Ops Manager

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-8431

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MongoDB Ops Manager versions 7.0 MongoDB Ops Manager versions prior to 8.0.23

Description An administrative user with permissions to configure webhooks can execute arbitrary commands. This is achieved by configuring and subsequently triggering webhooks that contain specific FreeMarker template syntax, a template engine used to generate text output based on data models.

Recommendations Update MongoDB Ops Manager version 7.0 to a patched version. Update MongoDB Ops Manager to version 8.0.23 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-8431

Affected Products

Ops Manager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-8431 · Security Note
• https://mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-8.0.23 · Note
• https://twitter.com/CVEnew/status/2054340953092051175 · Twitter Post