News for hackers. Stuff that matters.

A comment on MongoBleed. Parent comment

Re:MongoBleed by erdaniels on Friday December 26, 2025 @04:46PM (#46396641)
No, but it's pretty common IME to create an Atlas cluster that has internet-wide access (0.0.0.0/0) when testing and forgetting to turn this off. According to https://jira.mongodb.org/browse/SERVER-115508, this affects unauthenticated ops. Based on the repro code itself, it looks like this happens way before authentication is checked for the corresponding OP at the OP_MSG decoding level.

So if you're using Atlas, check that your Cluster has auto upgraded already. If you're using 0.0.0.0/0, stop doing that and prefer a limited IP address range and even better, use VPC Peering or other security/network boundary features.

[ Parent | on HN ]
Re:MongoBleed by computerfan494 on Friday December 26, 2025 @05:06PM (#46396823)
We received communication that all Atlas clusters were upgraded with the fix before the vulnerability was announced.
[ Parent | on HN ]
Re:MongoBleed by yearolinuxdsktp on Friday December 26, 2025 @07:19PM (#46397835)
This is a good example of a benefit of certificate-based authentication option for MongoDB, because you need to at least present a valid client certificate to transmit any data.
[ Parent | on HN ]
Re:MongoBleed by nailer on Monday December 29, 2025 @12:29PM (#46422982)
> No, but it's pretty common IME to create an Atlas cluster that has internet-wide access (0.0.0.0/0) when testing and forgetting to turn this off.

That is a ridiculous default.

[ Parent | on HN ]