CVE-2026-87108
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the r…
Published Oct 9, 2026 · updated Oct 15, 2026 · mongodb ops manager
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 9, 2026 · NIST NVD
Detected
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
Oct 15, 2026 · NIST NVD
Updated
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
Affected
- cpe mongodb/ops managerversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-87108
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-87108
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and c
nvd.nist.gov