CVE-2026-126835 · Package
NO FIX YET
The MongoDB Node.js driver does not consistently enforce its permitted-host list during OIDC authentication. An attacker who can influence the connection settings can get the application's bearer token sent to a host outside that list, exposing the credential.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use the MongoDB Node.js driver with OIDC authentication and a permitted-host restriction, where the connection settings can be influenced by someone outside the team. Applications that do not use OIDC, or that fully control their connection configuration, are less exposed. The sources do not name the affected driver versions.
Not affected if fixed-connection-config, no-oidc-auth
Who cares mongodb, node.js, oidc
mongodb npm package with npm ls mongodb.authMechanism=MONGODB-OIDC or an ALLOWED_HOSTS / allowedHosts setting in the connection code.No fix yet, per the sources.
The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of permitted hosts, which may result in unintended disclosure of that credential. No database account is required; the party supplying the connection configuration needs only to influence the settings the application passes to the driver.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.