← Vulnerability feed

Vulnerability record · CVE-2021-20335 · published 11 February 2021

CVE-2021-20335: Mongodb ops manager cleartext transmission vulnerability

Mongodb · Ops Manager

For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. This issue is temporary and eventually corrects itself after MongoDB Ops Manager instances have finished upgrading to MongoDB Ops Manager 4.4. In addition, customers must be running with clientCertificateMode=OPTIONAL / allowConnectionsWithoutCertificates=true to be impacted*.* Customers upgrading from Ops Manager 4.2.X to 4.2.24 and finally to Ops Manager 4.4.13+ are unaffected by this issue.

4.6 CVSS 3.1 Medium EPSS 0.14% · top 97.4% CWE-319 · Cleartext transmission
4.6CVSS 3.1 base score, v2 4.1
0.14%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. This issue is temporary and eventually corrects itself after MongoDB Ops Manager instances have finished upgrading to MongoDB Ops Manager 4.4. In addition, customers must be running with clientCertificateMode=OPTIONAL / allowConnectionsWithoutCertificates=true to be impacted*.* Customers upgrading from Ops Manager 4.2.X to 4.2.24 and finally to Ops Manager 4.4.13+ are unaffected by this issue.

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://docs.opsmanager.mongodb.com/v4.2/release-notes/application/#onprem-server-4-2-23 Vendor Advisory
https://docs.opsmanager.mongodb.com/v4.2/release-notes/application/#onprem-server-4-2-23 Vendor Advisory

Track CVE-2021-20335 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.4CVE-2026-8431Mongodb ops manager command injection vulnerabilityAn administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specif…EPSS 0.71%6.5CVE-2020-7927Mongodb ops manager vulnerabilitySpecially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. T…EPSS 1.0%5.3CVE-2019-2388Mongodb ops manager vulnerabilityIn affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops …EPSS 1.00%

Source: NIST National Vulnerability Database (record CVE-2021-20335), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.