Skip to content
OpenAdvisories
High · 7.4 CVE-2026-120808 EUVD-2026-122899GHSA-hqj2-5572-frj2

Certificate Validation Bypass via IPv6 trust-result skip in macOS TLS client

Published Nov 10, 2026 · Updated Nov 13, 2026 · Assigned by mongodb

Description

An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connections to IPv6-addressed peers. When a MongoDB process using the Apple SecureTransport TLS backend connects to an IPv6 target, the trust evaluation result from SecTrustEvaluate is silently discarded, regardless of whether the peer's certificate is trusted. An on-path party could exploit this by presenting a self-signed certificate containing the target's IPv6 address in the Subject Alternative Name to intercept and modify encrypted inter-node or external service traffic. This issue only affects MongoDB processes running on macOS with the Apple SecureTransport TLS provider.

Affected products

VendorProductAffectedFixed
MongoDB MongoDB Server 9.0.0 – < 9.0.7, 8.3.0 – < 8.3.16, 8.0.0 – < 8.0.37, 7.0.0 – < 7.0.48 9.0.7

Advisories 1

References