An attacker can exploit a flaw in MongoDB Server's handling of PROXY Protocol v2 over a Unix domain socket to bypass role validation based on the configured tlsCATrusts allow‑list. The error originates from CWE‑863, and allows roles derived from a valid X.509 client certificate to be assigned without verifying they appear on the allow‑list. This results in unintended role assignments following MONGODB‑X509 authentication, effectively enabling a client to gain privileges it is not authorized to use.

Any MongoDB Server that enables PROXY Protocol v2 on a Unix domain socket. The vulnerability requires an attacker to have local access to the Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority. Specific version ranges are not listed; all releases that support this configuration may be affected.

The CVSS score of 7.2 indicates high severity. The EPSS score indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack requires local access to the Unix domain socket and a valid X.509 client certificate, so only users or processes with such privileges can exploit it. If an attacker gains local access or a privileged account, they can use this flaw to elevate privileges within the database. The potential impact remains significant because it undermines authentication and authorization controls.