Mongodb Server vulnerabilities

CVE-2026-18692 [HIGH] CWE-416 CVE-2026-18692: An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated us An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.

CVE-2026-82053 [HIGH] CWE-863 CVE-2026-82053: A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections ca A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments b

CVE-2026-82067 [HIGH] CWE-178 CVE-2026-82067: Improper handling of case sensitivity in the configuration validation component of MongoDB Server ma Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full i

CVE-2026-13059 [HIGH] CWE-807 CVE-2026-13059: An authenticated user with low privileges may be able to perform unauthorized reads and writes on da An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.

CVE-2026-18691 [HIGH] CWE-757 CVE-2026-18691: An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable networ An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially all

CVE-2026-82071 [HIGH] CWE-787 CVE-2026-82071: Insufficient validation of storage engine configuration options in MongoDB Server allows an authenti Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with pot

CVE-2026-18690 [HIGH] CWE-863 CVE-2026-18690: An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.

CVE-2026-9753 [HIGH] CWE-1287 CVE-2026-9753: The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff con The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.

CVE-2026-13078 [HIGH] CWE-862 CVE-2026-13078: A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine uncond A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to re

CVE-2026-82061 [HIGH] CWE-416 CVE-2026-82061: A use-after-free security issue exists in the server's query execution memory tracking subsystem. An A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required.

CVE-2026-89099 [HIGH] CWE-362 CVE-2026-89099: A race condition in the document value layer of MongoDB Server can allow concurrent server threads t A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in s

CVE-2026-13072 [HIGH] CWE-122 CVE-2026-13072: When compute mode is enabled on a standalone mongod instance, insufficient validation of externally When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

CVE-2026-82075 [HIGH] CWE-770 CVE-2026-82075: An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sha An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to

CVE-2026-82066 [HIGH] CWE-125 CVE-2026-82066: A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. A A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable

CVE-2026-18712 [HIGH] CWE-863 CVE-2026-18712: An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticate An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perf

CVE-2026-82064 [HIGH] CWE-617 CVE-2026-82064: A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of servi A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about internal state do not hold for all member configurations

CVE-2026-9740 [HIGH] CWE-674 CVE-2026-9740: A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash th A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.

CVE-2026-18697 [HIGH] CWE-617 CVE-2026-18697: An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a m An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.

CVE-2026-18693 [HIGH] CWE-787 CVE-2026-18693: An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user wi An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially ca

CVE-2026-6914 [HIGH] CWE-191 CVE-2026-6914: Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of av Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server v7.0 versions prior to 7.0.32