CVE-2025-12893

The record

Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems. Additionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. This vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2

Affected packages

Related vulnerabilities

• CVE-2025-14345 A post-authentication flaw in the network two-phase commit protocol used for cross-shard… Also affects mongodb
• CVE-2025-13643 A user with access to the cluster with a limited set of privilege actions may be able to… Also affects mongodb
• CVE-2025-13644 MongoDB Server may experience an invariant failure during batched delete operations when… Also affects mongodb
• CVE-2025-13507 Inconsistent object size validation in time series processing logic may result in later… Also affects mongodb
• CVE-2025-12657 The KMIP response parser built into mongo binaries is overly tolerant of certain… Also affects mongodb
• CVE-2024-8305 prepareUnique index may cause secondaries to crash due to incorrect enforcement of index… Also affects mongodb
• CVE-2024-7553 Incorrect validation of files loaded from a local untrusted directory may allow local… Also affects mongodb
• CVE-2024-3372 Improper validation of certain metadata input may result in the server not correctly… Also affects mongodb