CVE-2025-3085 is a High severity (CVSS 8.1) flaw in MongoDB Server on Linux. With TLS and CRL checking enabled, the server did not check revocation status of intermediate certificates in a peer's chain. Fixed in 5.0.31, 6.0.20, 7.0.16 and 8.0.4, so upgrade to the matching release.
What's affected
MongoDB's own ticket, SERVER-95445, lists the affected and fixed versions:
- MongoDB Server 5.0 before 5.0.31
- MongoDB Server 6.0 before 6.0.20
- MongoDB Server 7.0 before 7.0.16
- MongoDB Server 8.0 before 8.0.4
The ticket also lists 8.1.0-rc0 as a fix version. The flaw only applies when two conditions are both true: the server runs on a Linux operating system, and CRL revocation status checking is enabled with TLS.
The record says that with the MONGODB-X509 mechanism, which is not enabled by default, this may lead to improper authentication, and that intra-cluster authentication may also be affected. The weakness is listed as CWE-299. The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The record does not list the CVE in CISA KEV.
How to check if you're exposed
First confirm the server version:
mongod --version
Or from the shell:
db.version()
Compare the result with the fixed releases above. Then check the two conditions. Open your mongod.conf or mongos.conf and look for a CRL file under the TLS settings:
grep -n -i "crl" /etc/mongod.conf
If the TLS section has a CRL file configured, revocation checking is on. Next, check whether X.509 authentication is in use by reviewing your authenticationMechanisms setting and any users created in the $external database. If you run replica sets or sharded clusters with X.509 member authentication, include them too.
If you use MongoDB Atlas or another managed service, ask your provider to confirm the patch level. This post does not cover their deployments.
What to do now
- Upgrade each affected deployment to the fixed release for its line: 5.0.31, 6.0.20, 7.0.16 or 8.0.4, or a later release.
- Upgrade replica set members one at a time, secondaries first, following MongoDB's rolling upgrade guidance for your version.
- Until you upgrade, restrict network access to MongoDB so only application hosts and cluster members can connect.
- Review who holds certificates signed by an intermediate authority you have revoked, and confirm those certificates cannot authenticate to the server.
- Check authentication logs for connections from certificate subjects you do not recognize.
Why it matters
A certificate chain has a leaf certificate, one or more intermediates, and a root. Revoking an intermediate is meant to cut off every certificate it issued. If the server only checks the revocation list for the leaf, a certificate issued under a revoked intermediate can still pass. The ticket's title says it directly: the SSL manager should validate the entire chain against the CRL, not just the leaf.
The risk is narrow, which is why the attack complexity is rated high. You need Linux, TLS, CRL checking and an unusual revocation event. But if you use certificates as database credentials, revocation is your emergency brake, and this bug means the brake does not apply to part of the chain. That is worth a planned upgrade rather than an emergency, unless you have recently revoked an intermediate.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I do not use X.509 authentication?
The record says MONGODB-X509 is not enabled by default and it names it as the case that may lead to improper authentication. It also says intra-cluster authentication may be affected, so check your cluster settings too.
Does this affect Windows or macOS servers?
The record states the required configuration includes running on a Linux operating system. Check MongoDB's ticket if you run another platform.
Sources
Last reviewed: 19 October 2026.
