---
id: "CVE-2026-120808"
page: "https://infrastack.ai/live/CVE-2026-120808"
kind: "vulnerability"
aliases: ["CVE-2026-120808"]
title: "MongoDB on macOS: IPv6 TLS connections accept untrusted certificates"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "MongoDB Server", "fixed": ["7.0.48", "8.0.37", "8.3.16", "9.0.7"], "affected": "7.0 < 7.0.48, 8.0 < 8.0.37, 8.3 < 8.3.16, 9.0 < 9.0.7 (macOS only)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["macos", "mongodb", "runtime", "self-hosted", "tls"]
not_affected_if: ["ipv4-only", "linux-or-windows", "other-tls-provider"]
published_at: "2026-11-10T20:18:51+00:00"
first_seen_at: "2026-11-10T20:46:02+00:00"
updated_at: "2026-11-10T20:50:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120808", "first_seen_at": "2026-11-10T20:46:02+00:00"}, {"source": "analyst", "url": "https://jira.mongodb.org/browse/SERVER-130681", "first_seen_at": "2026-11-10T20:50:59+00:00", "cites": ["https://jira.mongodb.org/browse/SERVER-130681"]}]
exploit_sources: []
---

# MongoDB on macOS: IPv6 TLS connections accept untrusted certificates

Link for people: https://infrastack.ai/live/CVE-2026-120808 (this .md is for agents)

MongoDB's macOS TLS client discards the certificate trust result for outbound connections to IPv6 peers, so it accepts any certificate. An attacker on the network path can present a self-signed certificate with the target's IPv6 address and read or modify the traffic.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB Server affected 7.0 < 7.0.48, 8.0 < 8.0.37, 8.3 < 8.3.16, 9.0 < 9.0.7 (macOS only) fixed 7.0.48, 8.0.37, 8.3.16, 9.0.7

## How to check

- On macOS hosts run `mongod --version` and compare with fixed versions: 7.0.48, 8.0.37, 8.3.16, 9.0.7. Anything older on those lines is in scope; 8.2 had a backport requested but SERVER-130681 lists no 8.2 fix version, so treat 8.2 as unknown and check MongoDB's advisory.
- Only the Apple SecureTransport TLS backend on macOS is affected (MongoDB docs: macOS uses Secure Transport). Linux and Windows builds use OpenSSL / Schannel.
- Only outbound connections to IPv6-address peers (inter-node, or to external services) are affected; check net/replica set member configs and connection strings for IPv6 literals.

## Fix

Upgrade MongoDB Server to 7.0.48, 8.0.37, 8.3.16 or 9.0.7 (or later on your line), per the Fix Version/s on MongoDB's SERVER-130681. Until upgraded, avoid TLS connections from macOS mongod to IPv6 peers (use IPv4 or hostnames resolving to IPv4).

## Timeline

- 2026-11-10T20:46:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120808
- 2026-11-10T20:50:59+00:00 analyst https://jira.mongodb.org/browse/SERVER-130681 — Fix versions read on MongoDB Jira SERVER-130681 (maintainer ticket); lower bounds of ranges and 8.2 status not confirmed from primary source; no exploitation or PoC seen.

## Documents

- [advisory] SERVER-130681 MacOS - Perform SecTrustEvaluate result check for IPv6 remote hosts https://jira.mongodb.org/browse/SERVER-130681

## From the sources

An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connections to IPv6-addressed peers. When a MongoDB process using the Apple SecureTransport TLS backend connects to an IPv6 target, the trust evaluation result from SecTrustEvaluate is silently discarded, regardless of whether the peer's certificate is trusted. An on-path party could exploit this by presenting a self-signed certificate containing the target's IPv6 address in the Subject Alternative Name to intercept and modify encrypted inter-node or external service traffic. This issue only affects MongoDB processes running on macOS with the Apple SecureTransport TLS provider.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_