{"id":"CVE-2026-103546","summary":"Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator","details":"In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation.","modified":"2026-10-07T02:47:33.101195453Z","published":"2026-10-05T21:50:14.273Z","database_specific":{"cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103546.json","cna_assigner":"mongodb"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103546.json"},{"type":"ADVISORY","url":"https://github.com/mongodb/mongodb-kubernetes/releases/tag/1.13.0"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103546"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mongodb/mongodb-kubernetes","events":[{"introduced":"0"},{"fixed":"75fa89bca8c1395a1beb0f244723f255f67f8719"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.13.0"}]}}],"versions":["1.12.0","1.11.0","1.10.0","v1-test","1.9.1","1.9.0","1.8.1","1.8.0","1.7.0","1.6.1","1.6.0","1.5.0","1.4.0","1.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103546.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}