CVE-2026-87110 Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints
Unauthenticated attackers can cause denial of service by repeatedly requesting costly monitoring endpoints without rate limiting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-87110?
CVE-2026-87110 is a medium-severity denial of service vulnerability in MongoDB Ops Manager, published on 9 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue.
Weakness: CWE-770
Which versions are affected by CVE-2026-87110?
It affects 1 product.
Products include Mongodb Ops Manager.
How do I fix CVE-2026-87110?
No fix has been published for CVE-2026-87110 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-87110 being exploited?
There is no known exploitation of CVE-2026-87110 in the wild and no public exploit code.
Other vulnerabilities in MongoDB Ops Manager
- CVE-2026-8431 Ops Manager RCE via webhook body
- CVE-2020-7927 Potential privilege escalation in Ops Manager API
- CVE-2021-20335 SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager
- CVE-2026-87109 Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings
- CVE-2019-2388 Potential exposure of log information in Ops Manager
Sources
Also known as GHSA-gcr6-2vh4-232q.