This vulnerability (CVE-2026-13067) in MongoDB Server arises when PROXY protocol v2 is used on the Unix domain socket path. In this scenario, the server fails to properly validate roles derived from X.509 client certificates against the configured tlsCATrusts allow-list, potentially allowing unauthorized role assignments following MONGODB-X509 authentication. The attack vector requires local access to the proxy Unix domain socket and a valid X.509 certificate from a trusted certificate authority. The CVSS 4.0 score is 7.2, indicating high severity with local attack vector, low attack complexity, and partial privileges required.

Successful exploitation can result in unintended role assignments, potentially granting higher privileges than intended to an attacker who has local access and a valid X.509 certificate. This could lead to unauthorized access or actions within the MongoDB Server environment. However, exploitation requires local access and a valid certificate, limiting the scope of the threat.

No official patch or remediation level has been published yet for this vulnerability. Patch status is not yet confirmed — check the MongoDB vendor advisory for current remediation guidance. Until a fix is available, restrict local access to the proxy Unix domain socket and carefully manage issuance and distribution of X.509 certificates to trusted entities only.