Mongodb Server vulnerabilities

CVE-2026-82074 [MEDIUM] CWE-863 CVE-2026-82074: MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An au MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to co

CVE-2026-18705 [MEDIUM] CWE-807 CVE-2026-18705: An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.

CVE-2026-82073 [MEDIUM] CWE-863 CVE-2026-82073: A security issue in the MongoDB Server aggregation framework allows an authenticated user with limit A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an internal command parameter that can be set by external

CVE-2026-13057 [MEDIUM] CWE-20 CVE-2026-13057: An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user ac An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due to insufficient input validation, an authenticated cli

CVE-2026-18711 [HIGH] CWE-416 CVE-2026-18711: An issue in MongoDB Server's query execution engine could allow an authenticated user with read and An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query r

CVE-2026-18687 [HIGH] CWE-191 CVE-2026-18687: MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in

CVE-2026-13060 [MEDIUM] CWE-863 CVE-2026-13060: An authenticated user with limited read privileges may be able to access documents from collections An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

CVE-2026-82069 [MEDIUM] CWE-212 CVE-2026-82069: A security issue in MongoDB Server's query statistics serialization on the router allows users with A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cl

CVE-2026-82070 [MEDIUM] CWE-522 CVE-2026-82070: A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user wit A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful expl

CVE-2026-18704 [MEDIUM] CWE-862 CVE-2026-18704: An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.

CVE-2026-13077 [HIGH] CWE-125 CVE-2026-13077: A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element

CVE-2026-18694 [HIGH] CWE-125 CVE-2026-18694: An issue in MongoDB Server's geospatial query processing could allow an authenticated user with writ An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memory outside its intended bounds. This could result in a s

CVE-2026-18706 [MEDIUM] CWE-416 CVE-2026-18706: An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able t An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.

CVE-2026-82054 [MEDIUM] CWE-770 CVE-2026-82054: A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under

CVE-2026-82068 [MEDIUM] CWE-617 CVE-2026-82068: A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a p A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster

CVE-2026-96297 [MEDIUM] CWE-416 CVE-2026-96297: Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data f Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query re

CVE-2026-13062 [MEDIUM] CWE-441 CVE-2026-13062: An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.

CVE-2026-18708 [MEDIUM] CWE-94 CVE-2026-18708: An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with writ An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other user

CVE-2026-82052 [MEDIUM] CWE-617 CVE-2026-82052: The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline s The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.

CVE-2026-13065 [MEDIUM] CWE-476 CVE-2026-13065: A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill wind A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.