Mongodb Server vulnerabilities

CVE-2026-13055 [MEDIUM] CWE-617 CVE-2026-13055: The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a Mon The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

CVE-2026-13058 [MEDIUM] CWE-617 CVE-2026-13058: An authenticated user with basic write privileges can cause the mongod process to terminate abnormal An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.

CVE-2026-82059 [MEDIUM] CWE-617 CVE-2026-82059: An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key ge

CVE-2026-9752 [MEDIUM] CWE-476 CVE-2026-9752: An authorized user could trigger a server crash by running a query with a 2dsphere index on a field An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-winding polygons are intentionally unsupported for indexing, but the guard that rejects them does not inspect members of a GeometryCollection, allowing the u

CVE-2026-13064 [MEDIUM] CWE-407 CVE-2026-13064: Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.

CVE-2026-82055 [MEDIUM] CWE-476 CVE-2026-82055: A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an internal object in an invalid, partially initialized state. During subsequ

CVE-2026-9748 [MEDIUM] CWE-617 CVE-2026-9748: The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this docume The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, T

CVE-2026-9741 [MEDIUM] CWE-319 CVE-2026-9741: A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption ( A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.

CVE-2026-18709 [MEDIUM] CWE-862 CVE-2026-18709: An issue in MongoDB Server could allow an authenticated user with direct network access to a shard t An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees

CVE-2026-9742 [MEDIUM] CWE-1287 CVE-2026-9742: When OIDC authentication is enabled in configuration, clients may set specific values in the "mechan When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.

CVE-2026-13075 [MEDIUM] CWE-770 CVE-2026-13075: An authenticated user can cause the mongod process to be terminated by the operating system under me An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.

CVE-2026-18701 [MEDIUM] CWE-843 CVE-2026-18701: An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.

CVE-2026-18699 [MEDIUM] CWE-476 CVE-2026-18699: An issue in MongoDB Server's query planner could allow an authenticated user with read-level privile An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connected clients and in-flight operations.

CVE-2026-13056 [MEDIUM] CWE-1325 CVE-2026-13056: Using expressions that generate large arrays it is possible to craft a query that creates very large Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.

CVE-2026-9743 [MEDIUM] CWE-476 CVE-2026-9743: In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authent

CVE-2026-13074 [MEDIUM] CWE-770 CVE-2026-13074: An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availabi

CVE-2026-9737 [MEDIUM] CWE-617 CVE-2026-9737: During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t exp During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.

CVE-2026-18695 [MEDIUM] CWE-617 CVE-2026-18695: An issue in MongoDB Server's handling of certain query predicates against time-series collections wi An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service.

CVE-2026-9747 [MEDIUM] CWE-617 CVE-2026-9747: Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb serv Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.

CVE-2026-18698 [MEDIUM] CWE-863 CVE-2026-18698: An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations, unauthorized modification of system collection data.