[ CVE-2026-87108 · Published 9 Oct 2026 ]
Vulnerability in MongoDB Ops Manager
CVSS 4.3
EPSS <1%No fix listed yet
[ Description ]Official description
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.