CVE-2026-8431 — Ops Manager RCE via webhook body

CVE-2026-8431

Ops Manager RCE via webhook body PUBLISHED

Description (CNA)

An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.

Affected (CNA)

Vendor / product	Versions
MongoDB, Inc. / Ops Manager	affected 7.0 before 8.0.23

CWE

CWE-77

References

https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-8.0.23

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.