CVE-2026-8431: 
MongoDB Ops Manager vulnerability analysis and mitigation

CVE-2026-8431 is a FreeMarker template injection vulnerability in MongoDB Ops Manager that allows an authenticated administrative user with webhook configuration privileges to execute arbitrary commands on the server. The vulnerability was published on May 12, 2026, and affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager 8.0.22 and prior. It carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 9.4 (Critical) (GitHub Advisory, MongoDB Release Notes).

The root cause is improper neutralization of special elements used in a command (CWE-77), specifically through unsanitized FreeMarker template syntax processed within webhook configurations. An attacker with administrative access to MongoDB Ops Manager can craft a webhook payload containing malicious FreeMarker template directives; when the webhook is triggered, the template engine evaluates the injected expressions and executes arbitrary OS-level commands in the context of the Ops Manager process. Exploitation requires high privileges (administrative access to webhook configuration) but no user interaction and has low attack complexity over a network vector (GitHub Advisory).

Successful exploitation grants the attacker full remote code execution on the MongoDB Ops Manager host, with high impact to confidentiality, integrity, and availability of both the vulnerable system and subsequent systems. An attacker could exfiltrate sensitive database credentials and configuration data, modify or destroy managed MongoDB deployments, disrupt Ops Manager availability, and potentially pivot laterally to managed MongoDB clusters under Ops Manager's control (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.053% (22nd percentile), indicating a currently low probability of exploitation in the near term (GitHub Advisory).

1. Gain Administrative Access: Obtain credentials for an administrative account in MongoDB Ops Manager that has permissions to configure webhooks (e.g., through credential theft, phishing, or insider access).
2. Navigate to Webhook Configuration: Log into the Ops Manager web interface and navigate to the webhook/alert notification configuration section.
3. Inject FreeMarker Template Payload: Create or modify a webhook configuration, embedding malicious FreeMarker template syntax in a field that is later processed server-side (e.g., a URL or payload body field). Example payload pattern: ${"freemarker.template.utility.Execute"?new()("id")} or similar FreeMarker SSTI payloads.
4. Trigger the Webhook: Cause the webhook to fire by triggering the associated alert condition or manually invoking the webhook test functionality.
5. Achieve Remote Code Execution: The Ops Manager FreeMarker template engine evaluates the injected expression and executes the embedded OS command in the context of the Ops Manager server process, enabling reverse shell establishment, data exfiltration, or further lateral movement to managed MongoDB clusters (GitHub Advisory).

• Logs: Ops Manager application logs showing webhook trigger events followed by unexpected process spawning or errors from the FreeMarker template engine; audit logs recording webhook configuration changes by administrative accounts.
• Process: Unusual child processes spawned by the Ops Manager Java process (e.g., sh, bash, cmd.exe, curl, wget, powershell) that are not part of normal Ops Manager operation.
• Network: Unexpected outbound connections from the Ops Manager host to external IP addresses or C2 infrastructure shortly after webhook trigger events.
• File System: New or modified files in the Ops Manager installation directory, unexpected cron jobs or scheduled tasks, or web shells dropped by the Ops Manager process account.

MongoDB has released a fix in MongoDB Ops Manager 8.0.23; users should upgrade to version 8.0.23 or later. All MongoDB Ops Manager 7.0 versions are affected, so users on the 7.0 branch should migrate to a patched 8.0.x release. As interim mitigations: restrict administrative access and webhook configuration permissions to only highly trusted users, monitor webhook configurations for suspicious FreeMarker template syntax, and implement network segmentation to limit access to the Ops Manager administrative interface (MongoDB Release Notes, GitHub Advisory).