CVE-2026-126835: [Node.js Driver] OIDC ENVIRONMENT confusion bypasses ALLOWED_HOSTS and leaks human-callback bearer tokens
The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of permitted hosts, which may result in unintended disclosure of that credential. No database account is required; the party supplying the connection configuration needs only to influence the settings the application passes to the driver.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the MongoDB Node.js driver with OIDC authentication are exposed when an attacker can influence the connection configuration passed by the application and the application provides a login callback that produces a bearer token. The issue concerns transmission of that callback-produced token to a host outside the configured permitted-host set.
Does exploitation require database credentials or a database account?
No. No database account is required. The attacker needs to influence the connection settings supplied to the driver and induce a user interaction, as indicated by the UI:R vector.
What is the available fixed release?
The provided release reference identifies v7.9.0 of the MongoDB Node.js driver.