MONGODB SERVER · CVE-2026-120808 · Runtime
FIX → 9.0.7 · 8.3.16 · 7.0.48 +1 ✓ verified
MongoDB's macOS TLS client discards the certificate trust result for outbound connections to IPv6 peers, so it accepts any certificate. An attacker on the network path can present a self-signed certificate with the target's IPv6 address and read or modify the traffic.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
MongoDB Server processes running on macOS (Apple SecureTransport TLS) that make outbound TLS connections to peers addressed by IPv6 literal, such as replica set members or sharded clusters on Macs. Linux and Windows deployments, and IPv4-only setups, can skip it. Most macOS use is development, so production exposure is likely small.
Not affected if ipv4-only, linux-or-windows, other-tls-provider
Who cares macos, mongodb, self-hosted, tls
mongod --version and compare with fixed versions: 7.0.48, 8.0.37, 8.3.16, 9.0.7. Anything older on those lines is in scope; 8.2 had a backport requested but SERVER-130681 lists no 8.2 fix version, so treat 8.2 as unknown and check MongoDB's advisory.An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connections to IPv6-addressed peers. When a MongoDB process using the Apple SecureTransport TLS backend connects to an IPv6 target, the trust evaluation result from SecTrustEvaluate is silently discarded, regardless of whether the peer's certificate is trusted. An on-path party could exploit this by presenting a self-signed certificate containing the target's IPv6 address in the Subject Alternative Name to intercept and modify encrypted inter-node or external service traffic. This issue only affects MongoDB processes running on macOS with the Apple SecureTransport TLS provider.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 9.0.7 · 8.3.16 · 7.0.48 +1
7.0.48, 8.0.37, 8.3.16 or 9.0.7 (or later on your line), per the Fix Version/s on MongoDB's SERVER-130681