Mongodb Server vulnerabilities

CVE-2026-82057 [MEDIUM] CWE-843 CVE-2026-82057: A security issue was discovered in MongoDB where an authenticated user with readWrite privileges cou A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently

CVE-2026-82076 [MEDIUM] CWE-190 CVE-2026-82076: An integer overflow in the query planning component of MongoDB Server can allow an authenticated use An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server

CVE-2026-82058 [MEDIUM] CWE-248 CVE-2026-82058: A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with r A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path performs unsafe numeric conversion on the user-controlled

CVE-2026-18696 [MEDIUM] CWE-863 CVE-2026-18696: An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-de An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined betwee

CVE-2026-13066 [MEDIUM] CWE-843 CVE-2026-13066: Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.

CVE-2026-18702 [MEDIUM] CWE-269 CVE-2026-18702: An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privilege An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitorin

CVE-2026-13076 [MEDIUM] CWE-770 CVE-2026-13076: An authenticated user can cause a process to be terminated by the operating system under An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and requires both write access to the database and the ability to ru

CVE-2026-82065 [MEDIUM] CWE-617 CVE-2026-82065: A security issue in the MongoDB Server's storage engine integration layer allows an authenticated us A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the

CVE-2026-13063 [MEDIUM] CWE-190 CVE-2026-13063: An authenticated user with standard read/write privileges can cause the mongod process to terminate An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively large memory allocation.

CVE-2026-9750 [MEDIUM] CWE-617 CVE-2026-9750: An authenticated user can cause a MongoDB server to crash or return incorrect results by creating do An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document fields and internal metadata in certain execution paths.

CVE-2026-13069 [MEDIUM] CWE-770 CVE-2026-13069: An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB s An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.

CVE-2026-9749 [MEDIUM] CWE-617 CVE-2026-9749: This issue can occur when running an aggregation pipeline that uses the internal $exchange stage con This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer (that is, many results are routed to the same consumer), the server reaches the code path where a full per-con

CVE-2026-9746 [MEDIUM] CWE-617 CVE-2026-9746: When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hit When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement.

CVE-2026-96299 [MEDIUM] CWE-617 CVE-2026-96299: A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticate A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allo

CVE-2026-104005 [MEDIUM] CWE-617 CVE-2026-104005: A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticate A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, al

CVE-2026-104004 [MEDIUM] CWE-476 CVE-2026-104004: MongoDB Server's collection validation feature may not properly handle certain expressions stored in MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.

CVE-2026-82062 [MEDIUM] CWE-863 CVE-2026-82062: A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production co

CVE-2026-18688 [HIGH] CWE-125 CVE-2026-18688: An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an o An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents.

CVE-2026-13071 [MEDIUM] CWE-416 CVE-2026-13071: An authenticated user with read access can cause the mongod process to be terminated through certain An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.

CVE-2026-18700 [MEDIUM] CWE-416 CVE-2026-18700: An issue in MongoDB Server's geospatial validation could allow an authenticated user with write priv An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service.