CVE-2026-18712
published 2026-08-11CVE-2026-18712: An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause…
PriorityP346high8.1CVSS 3.1
AVNACLPRLUINSUCNIHAH
EPSS
0.17%
6.3th percentile
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | mongodb | — | — |
| mongodb | mongodb | — | — |
| mongodb | mongodb | — | — |
| mongodb | mongodb | >= 7.0.0 < 7.0.40 | 7.0.40 |
| mongodb | mongodb | >= 8.0.0 < 8.0.29 | 8.0.29 |
| mongodb | mongodb | 8.2.0 – 8.2.12 | — |
| mongodb | mongodb | >= 8.3.0 < 8.3.8 | 8.3.8 |
| mongodb | mongodb_server | >= 7.0 < 7.0.40 | 7.0.40 |
| mongodb | mongodb_server | >= 8.0 < 8.0.29 | 8.0.29 |
| mongodb | mongodb_server | >= 8.3.0 < 8.3.8 | 8.3.8 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
nvdv4.07.2HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MongoDB Server up to 7.0.39/8.0.28/8.3.7 Queryable Encryption improper authorization (Nessus ID 343460)
vuldb·2026-09-08·CVSS 8.1
CVE-2026-18712 [HIGH] MongoDB Server up to 7.0.39/8.0.28/8.3.7 Queryable Encryption improper authorization (Nessus ID 343460)
A vulnerability classified as problematic was found in MongoDB Server up to 7.0.39/8.0.28/8.3.7. This issue affects some unknown processing of the component Queryable Encryption. The manipulation results in improper authorization.
This vulnerability was named CVE-2026-18712. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is advised.
GHSA
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction
ghsa_unreviewed·2026-08-11
CVE-2026-18712 [HIGH] CWE-863 An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-11
Published