{"id":"CVE-2026-126835","kind":"vulnerability","aliases":["CVE-2026-126835"],"related":[],"title":"MongoDB Node.js driver may send OIDC bearer tokens to unpermitted hosts","description":"The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of permitted hosts, which may result in unintended disclosure of that credential. No database account is required; the party supplying the connection configuration needs only to influence the settings the application passes to the driver.","summary":"The MongoDB Node.js driver does not consistently enforce its permitted-host list during OIDC authentication. An attacker who can influence the connection settings can get the application's bearer token sent to a host outside that list, exposing the credential.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mongodb","node.js","oidc","package"],"not_affected_if":["fixed-connection-config","no-oidc-auth"],"how_to_check":"- Check whether the project depends on the `mongodb` npm package with `npm ls mongodb`.\n- Check whether OIDC authentication is configured, by looking for `authMechanism=MONGODB-OIDC` or an `ALLOWED_HOSTS` / `allowedHosts` setting in the connection code.\n- Check whether connection strings or OIDC settings can be influenced by untrusted input.","fix":null,"status":"open","published_at":"2026-11-12T17:17:33+00:00","first_seen_at":"2026-11-12T17:39:38+00:00","triaged_at":"2026-11-12T17:40:01+00:00","updated_at":"2026-11-12T17:40:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T17:40:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Node.js driver may send OIDC bearer tokens to unpermitted hosts","impact":"medium","summary":"The MongoDB Node.js driver does not consistently enforce its permitted-host list during OIDC authentication. An attacker who can influence the connection settings can get the application's bearer token sent to a host outside that list, exposing the credential.","audience":"developers","category":"package","nicknames":[],"who_cares":["mongodb","node.js","oidc"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"bearer token disclosed to an unpermitted host","analyst_note":"Find the affected and fixed driver versions in the release notes (github.com) and the NVD entry, since the sources do not give them.","how_to_check":"- Check whether the project depends on the `mongodb` npm package with `npm ls mongodb`.\n- Check whether OIDC authentication is configured, by looking for `authMechanism=MONGODB-OIDC` or an `ALLOWED_HOSTS` / `allowedHosts` setting in the connection code.\n- Check whether connection strings or OIDC settings can be influenced by untrusted input.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-oidc-auth","fixed-connection-config"],"who_is_affected":"Applications that use the MongoDB Node.js driver with OIDC authentication and a permitted-host restriction, where the connection settings can be influenced by someone outside the team. Applications that do not use OIDC, or that fully control their connection configuration, are less exposed. The sources do not name the affected driver versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000765,"input_tokens":4597,"output_tokens":611,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126835':14A,17A '-2026':13A,16A 'account':116C 'applic':49B,86C,132C 'attack':39B 'authent':37B,78C 'bearer':7A,51B,80C 'callback':90C 'configur':100C,124C 'connect':44B,123C 'consist':28B,69C 'credenti':62B,113C 'cve':12A,15A 'databas':115C 'disclosur':110C 'driver':3A,25B,66C,136C 'embed':85C 'enforc':29B,70C 'expos':60B 'get':47B 'host':11A,33B,56B,74C,97C,104C 'influenc':42B,128C 'list':34B,59B 'login':89C 'may':4A,91C,106C 'mongodb':1A,18B,23B,64C 'need':125C 'node.js':2A,19B,24B,65C 'oidc':6A,20B,36B,77C 'outsid':57B,98C 'packag':21B 'parti':120C 'pass':133C 'permit':32B,73C,103C 'permitted-host':31B,72C 'produc':82C 'requir':118C 'restrict':75C 'result':107C 'send':5A 'sent':53B 'set':45B,101C,130C 'suppli':121C 'therefor':92C 'token':8A,52B,81C 'transmit':94C 'unintend':109C 'unpermit':10A","nicknames":[],"mitigations":[],"who_affected":"Applications that use the MongoDB Node.js driver with OIDC authentication and a permitted-host restriction, where the connection settings can be influenced by someone outside the team. Applications that do not use OIDC, or that fully control their connection configuration, are less exposed. The sources do not name the affected driver versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mongodb","nodejs","oidc","package"],"campaign_type":null,"search_a":"'-126835':14A,17A '-2026':13A,16A 'bearer':7A 'cve':12A,15A 'driver':3A 'host':11A 'may':4A 'mongodb':1A 'node.js':2A 'oidc':6A 'send':5A 'token':8A 'unpermit':10A","search_b":"'applic':49B 'attack':39B 'authent':37B 'bearer':51B 'connect':44B 'consist':28B 'credenti':62B 'driver':25B 'enforc':29B 'expos':60B 'get':47B 'host':33B,56B 'influenc':42B 'list':34B,59B 'mongodb':18B,23B 'node.js':19B,24B 'oidc':20B,36B 'outsid':57B 'packag':21B 'permit':32B 'permitted-host':31B 'sent':53B 'set':45B 'token':52B","search_c":"'account':116C 'applic':86C,132C 'authent':78C 'bearer':80C 'callback':90C 'configur':100C,124C 'connect':123C 'consist':69C 'credenti':113C 'databas':115C 'disclosur':110C 'driver':66C,136C 'embed':85C 'enforc':70C 'host':74C,97C,104C 'influenc':128C 'login':89C 'may':91C,106C 'mongodb':64C 'need':125C 'node.js':65C 'oidc':77C 'outsid':98C 'parti':120C 'pass':133C 'permit':73C,103C 'permitted-host':72C 'produc':82C 'requir':118C 'restrict':75C 'result':107C 'set':101C,130C 'suppli':121C 'therefor':92C 'token':81C 'transmit':94C 'unintend':109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T17:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126835","severity":null,"published_at":"2026-11-12T17:17:33+00:00","modified_at":"2026-11-12T17:17:33+00:00","first_seen_at":"2026-11-12T17:39:38+00:00","fetched_at":"2026-11-12T17:39:38+00:00","note":null}],"documents":[{"id":136851,"url":"https://github.com/mongodb/node-mongodb-native/releases/tag/v7.9.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}