Description

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T22:16:54.510Z",
  "pubdate": "2026-08-28T22:16:54.510Z",
  "executiveSummary": "This vulnerability involves an improper authentication implementation within the mongosqld component when configured to utilize client certificate authority files.\nThe flaw manifests as an optional client certificate request during the TLS handshake, wherein the server fails to enforce the presentation of a valid certificate.\nConsequently, remote attackers with network connectivity to the listener can establish a TLS-encrypted session without providing cryptographic identity proof.\nIn environments relying exclusively on certificate-based authentication for access control, this behavior effectively renders the authentication mechanism bypassable.\nSuccessful exploitation allows unauthorized entities to gain full access to the underlying MongoDB data exposed through the connector, leading to significant information disclosure and potential data integrity risks.\nThe vulnerability represents a critical security control failure for deployments expecting mutual TLS (mTLS) to act as the primary barrier against unauthorized access.",
  "technicalDetails": "The root cause of this vulnerability lies in the TLS handshake handling logic within the mongosqld service. While the configuration mandates a client certificate authority (CA) file, the implementation incorrectly treats the presentation of a client certificate as an optional parameter rather than a mandatory requirement during the TLS session establishment.\nUnder standard mutual TLS (mTLS) configurations, a server should issue a 'Certificate Request' and subsequently abort the handshake if the client fails to provide a certificate signed by a trusted CA. In the affected mongosqld configuration, the server requests the certificate but proceeds with the handshake regardless of whether the client presents one.\nThe exploitation flow is straightforward: A remote attacker identifies a target mongosqld instance that is configured to require client certificates. By initiating a standard TLS connection, the attacker ignores the server's optional request for a certificate. Since the handshake proceeds to completion despite the missing credentials, the attacker successfully establishes an encrypted transport layer session.\nOnce the session is established, the application layer logic in mongosqld proceeds as if the client has satisfied authentication requirements. Because the connector relies on these certificates as the sole source of user identity, the service treats the unauthenticated connection as an authorized session. This results in the exposure of all MongoDB data accessible to the connector configuration.\nThis vulnerability does not require complex payloads or memory corruption techniques; it is a logic flaw in the authentication state machine. The attack is accessible to any remote party with network-level reach to the mongosqld port. The impact is a complete bypass of identity-based access controls, allowing unauthorized data retrieval, reconnaissance of the MongoDB backend, and potential manipulation of exposed data streams.\nThis flaw specifically affects instances where 'certificate' authentication is the primary defensive posture. Without secondary authentication layers, the risk of unauthorized data access is high."
}