This vulnerability (CWE-863) occurs in MongoDB Server when PROXY protocol v2 is used on Unix domain socket paths. The issue causes roles derived from X.509 client certificates to not be properly validated against the configured tlsCATrusts allow-list. As a result, users authenticated via MONGODB-X509 may receive unintended roles. The attack vector requires local access to the proxy Unix domain socket and possession of a valid X.509 certificate issued by a trusted certificate authority. The CVSS 4.0 score is 7.2, reflecting a high severity with local attack vector, low attack complexity, and partial privileges required.

An attacker with local access to the proxy Unix domain socket and a valid X.509 certificate trusted by the server can gain unintended role assignments, potentially escalating privileges or accessing unauthorized resources within MongoDB. This incorrect authorization undermines the intended access controls configured via tlsCATrusts allow-list, increasing the risk of privilege escalation or unauthorized data access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to the proxy Unix domain socket to trusted users only and carefully control issuance and distribution of X.509 certificates trusted by MongoDB. Monitor MongoDB server configurations and logs for unusual role assignments related to MONGODB-X509 authentication.