{"id":"CVE-2026-120808","kind":"vulnerability","aliases":["CVE-2026-120808"],"related":[],"title":"MongoDB on macOS: IPv6 TLS connections accept untrusted certificates","description":"An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connections to IPv6-addressed peers. When a MongoDB process using the Apple SecureTransport TLS backend connects to an IPv6 target, the trust evaluation result from SecTrustEvaluate is silently discarded, regardless of whether the peer's certificate is trusted. An on-path party could exploit this by presenting a self-signed certificate containing the target's IPv6 address in the Subject Alternative Name to intercept and modify encrypted inter-node or external service traffic. This issue only affects MongoDB processes running on macOS with the Apple SecureTransport TLS provider.","summary":"MongoDB's macOS TLS client discards the certificate trust result for outbound connections to IPv6 peers, so it accepts any certificate. An attacker on the network path can present a self-signed certificate with the target's IPv6 address and read or modify the traffic.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MongoDB Server","fixed":["7.0.48","8.0.37","8.3.16","9.0.7"],"affected":"7.0 < 7.0.48, 8.0 < 8.0.37, 8.3 < 8.3.16, 9.0 < 9.0.7 (macOS only)","ecosystem":"vendor"}],"ecosystems":[],"tags":["macos","mongodb","runtime","self-hosted","tls"],"not_affected_if":["ipv4-only","linux-or-windows","other-tls-provider"],"how_to_check":"- On macOS hosts run `mongod --version` and compare with fixed versions: 7.0.48, 8.0.37, 8.3.16, 9.0.7. Anything older on those lines is in scope; 8.2 had a backport requested but SERVER-130681 lists no 8.2 fix version, so treat 8.2 as unknown and check MongoDB's advisory.\n- Only the Apple SecureTransport TLS backend on macOS is affected (MongoDB docs: macOS uses Secure Transport). Linux and Windows builds use OpenSSL / Schannel.\n- Only outbound connections to IPv6-address peers (inter-node, or to external services) are affected; check net/replica set member configs and connection strings for IPv6 literals.","fix":"Upgrade MongoDB Server to 7.0.48, 8.0.37, 8.3.16 or 9.0.7 (or later on your line), per the Fix Version/s on MongoDB's SERVER-130681. Until upgraded, avoid TLS connections from macOS mongod to IPv6 peers (use IPv4 or hostnames resolving to IPv4).","status":"open","published_at":"2026-11-10T20:18:51+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","triaged_at":"2026-11-10T20:47:21+00:00","updated_at":"2026-11-10T20:50:59+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-10T20:47:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB on macOS: IPv6 TLS connections accept untrusted certificates","impact":"high","summary":"MongoDB's macOS TLS client discards the certificate trust result for outbound connections to IPv6 peers, so it accepts any certificate. An attacker on the network path can present a self-signed certificate with the target's IPv6 address and read or modify the traffic.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["mongodb","macos","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"on-path attacker reads and modifies MongoDB inter-node and service traffic","analyst_note":"Sources do not list affected or fixed MongoDB versions; find the MongoDB advisory for CVE-2026-120808 and its fixed release lines.","how_to_check":"- Run `mongod --version` on macOS hosts and compare against the fixed versions once published.\n- Check whether the process uses the Apple SecureTransport TLS provider (the `Apple` provider in `net.tls` build or config).\n- Look for outbound TLS connections from MongoDB to IPv6 addresses.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["linux-or-windows","ipv4-only","other-tls-provider"],"who_is_affected":"Only MongoDB processes running on macOS with the Apple SecureTransport TLS provider are affected, and only for outbound connections to IPv6 peers. Linux and Windows deployments, and macOS hosts using other TLS backends, are not described as affected. Teams running MongoDB on Macs with IPv6 cluster or service traffic should review it first.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000787,"input_tokens":4695,"output_tokens":634,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources do not list affected or fixed MongoDB versions; find the MongoDB advisory for CVE-2026-120808 and its fixed release lines.","search":"'-120808':12A,15A '-2026':11A,14A 'accept':7A,43B 'address':64B,96C,151C 'affect':172C 'altern':155C 'appl':104C,180C 'attack':47B 'backend':107C 'bypass':89C 'certif':9A,32B,45B,58B,82C,128C,145C 'chain':84C 'chain-of-trust':83C 'client':29B,79C 'connect':6A,37B,92C,108C 'contain':146C 'could':136C 'cve':10A,13A 'discard':30B,121C 'encrypt':161C 'evalu':115C 'exist':73C 'exploit':137C 'extern':166C 'host':23B 'implement':80C 'inter':163C 'inter-nod':162C 'intercept':158C 'ipv6':4A,39B,63B,95C,111C,150C 'ipv6-addressed':94C 'issu':72C,170C 'maco':3A,18B,27B,77C,177C 'modifi':68B,160C 'mongodb':1A,16A,19B,25B,75C,100C,173C 'name':156C 'network':50B 'node':164C 'on-path':132C 'outbound':36B,91C 'parti':135C 'path':51B,134C 'peer':40B,97C,126C 'present':53B,140C 'process':101C,174C 'provid':183C 'read':66B 'regardless':122C 'result':34B,116C 'run':175C 'runtim':20B 'sectrustevalu':118C 'securetransport':105C,181C 'self':22B,56B,143C 'self-host':21B 'self-sign':55B,142C 'server':17A 'servic':167C 'sign':57B,144C 'silent':120C 'subject':154C 'target':61B,112C,148C 'tls':5A,24B,28B,78C,106C,182C 'traffic':70B,168C 'trust':33B,86C,114C,130C 'untrust':8A 'use':102C 'valid':87C 'whether':124C","nicknames":[],"mitigations":[],"who_affected":"MongoDB Server processes running on macOS (Apple SecureTransport TLS) that make outbound TLS connections to peers addressed by IPv6 literal, such as replica set members or sharded clusters on Macs. Linux and Windows deployments, and IPv4-only setups, can skip it. Most macOS use is development, so production exposure is likely small.","tier":"B","verified":{"fix":{"at":"2026-11-10T20:50:59Z","by":"analyst","doc":"https://jira.mongodb.org/browse/SERVER-130681","run_id":2714}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mongodbserver","server"],"ptokens":["mongodb","server"],"labels":["critical","macos","mongodb","runtime","selfhosted","tls"],"campaign_type":null,"search_a":"'-120808':12A,15A '-2026':11A,14A 'accept':7A 'certif':9A 'connect':6A 'cve':10A,13A 'ipv6':4A 'maco':3A 'mongodb':1A,16A 'server':17A 'tls':5A 'untrust':8A","search_b":"'accept':43B 'address':64B 'attack':47B 'certif':32B,45B,58B 'client':29B 'connect':37B 'discard':30B 'host':23B 'ipv6':39B,63B 'maco':18B,27B 'modifi':68B 'mongodb':19B,25B 'network':50B 'outbound':36B 'path':51B 'peer':40B 'present':53B 'read':66B 'result':34B 'runtim':20B 'self':22B,56B 'self-host':21B 'self-sign':55B 'sign':57B 'target':61B 'tls':24B,28B 'traffic':70B 'trust':33B","search_c":"'address':96C,151C 'affect':172C 'altern':155C 'appl':104C,180C 'backend':107C 'bypass':89C 'certif':82C,128C,145C 'chain':84C 'chain-of-trust':83C 'client':79C 'connect':92C,108C 'contain':146C 'could':136C 'discard':121C 'encrypt':161C 'evalu':115C 'exist':73C 'exploit':137C 'extern':166C 'implement':80C 'inter':163C 'inter-nod':162C 'intercept':158C 'ipv6':95C,111C,150C 'ipv6-addressed':94C 'issu':72C,170C 'maco':77C,177C 'modifi':160C 'mongodb':75C,100C,173C 'name':156C 'node':164C 'on-path':132C 'outbound':91C 'parti':135C 'path':134C 'peer':97C,126C 'present':140C 'process':101C,174C 'provid':183C 'regardless':122C 'result':116C 'run':175C 'sectrustevalu':118C 'securetransport':105C,181C 'self':143C 'self-sign':142C 'servic':167C 'sign':144C 'silent':120C 'subject':154C 'target':112C,148C 'tls':78C,106C,182C 'traffic':168C 'trust':86C,114C,130C 'use':102C 'valid':87C 'whether':124C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120808","severity":null,"published_at":"2026-11-10T20:18:51+00:00","modified_at":"2026-11-10T20:18:51+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","fetched_at":"2026-11-10T20:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120808:2714","url":"https://jira.mongodb.org/browse/SERVER-130681","severity":null,"published_at":"2026-11-10T20:50:59+00:00","modified_at":"2026-11-10T20:50:59+00:00","first_seen_at":"2026-11-10T20:50:59+00:00","fetched_at":"2026-11-10T20:50:59+00:00","note":"Fix versions read on MongoDB Jira SERVER-130681 (maintainer ticket); lower bounds of ranges and 8.2 status not confirmed from primary source; no exploitation or PoC seen.","cites":["https://jira.mongodb.org/browse/SERVER-130681"]}],"documents":[{"id":118297,"url":"https://jira.mongodb.org/browse/SERVER-130681","title":"SERVER-130681 MacOS - Perform SecTrustEvaluate result check for IPv6 remote hosts","kind":"advisory","source":"analyst","publisher":null,"text":"Type: Bug. Resolution: Fixed. Fix Version/s: 8.3.16, 9.0.7, 8.0.37, 7.0.48. Backport requested: v9.0, v8.3, v8.0, v7.0, v8.2. Resolved Nov 10 2026 19:23 UTC. Assigned team: Server Security.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}