MongoDB Controllers for Kubernetes is affected by an insufficient validation flaw that allows a user with the ability to modify an OpsManager custom resource to trigger unintended administrative actions within Ops Manager. The vulnerability arises from inadequate checks on the backup configuration submitted through the custom resource. As a result, an attacker could gain elevated control over Ops Manager functions that are governed by the backup reconciliation feature, potentially causing misconfiguration or unauthorized data manipulation. This flaw is identified as CWE‑918, reflecting improper validation of user-controlled data that may lead to denial of service, information disclosure, or privilege escalation. The nature of the impact is limited to systems that have Enterprise Ops Manager backup reconciliation enabled and where the attacker holds permission to alter OpsManager custom resources.

The affected product is MongoDB, Inc. Mongodb Controllers for Kubernetes. No specific release version is listed in the advisory, so all deployments of the controller in use should be reviewed for potential vulnerabilities.

The CVSS v3 score of 2.3 denotes a low severity. EPSS data is not provided, and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. The attack vector is inferred to be a privilege‑based assault where an adversary confers the capability to edit the OpsManager custom resource, such as through compromised Kubernetes credentials or compromised service accounts. Exploitation requires that Enterprise Ops Manager backup reconciliation be active, as that is the context in which the validation failure occurs. With these conditions met, an attacker can trigger unauthorized administrative changes within Ops Manager, although no remote unauthenticated exploitation path is described.