Mongodb Server vulnerabilities

CVE-2026-13067 [MEDIUM] CWE-863 CVE-2026-13067: When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certi When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509

CVE-2026-82060 [MEDIUM] CWE-943 CVE-2026-82060: In MongoDB, insufficient validation of shard key values during document insertion allowed authentica In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embe

CVE-2026-9735 [MEDIUM] CWE-532 CVE-2026-9735: MongoDB server may log authentication parameters, including credentials, to the server log during SA MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.

CVE-2026-103965 [MEDIUM] CWE-94 CVE-2026-103965: An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled i An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

CVE-2026-82056 [MEDIUM] CWE-416 CVE-2026-82056: A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read w A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed, leading to a server crash. An authenticated user w

CVE-2026-5170 [MEDIUM] CWE-617 CVE-2026-5170: A user with access to the cluster with a limited set of privilege actions can trigger a crash of a m A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set. This issue affects MongoDB Server v8

CVE-2026-9751 [MEDIUM] CWE-532 CVE-2026-9751: The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.

CVE-2026-82063 [MEDIUM] CWE-416 CVE-2026-82063: A use-after-free security issue in the cursor management component of MongoDB Server allows an authe A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently dereferenced during cursor cleanup, leading to a server process crash.

CVE-2026-6915 [MEDIUM] CWE-1284 CVE-2026-6915: An authorization flaw in the user management command could allow an authenticated user to make limit An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account.

CVE-2026-18703 [MEDIUM] CWE-863 CVE-2026-18703: An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding u An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intend

CVE-2026-13070 [MEDIUM] CWE-476 CVE-2026-13070: A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a ma A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificat

CVE-2026-13073 [MEDIUM] CWE-617 CVE-2026-13073: An authenticated user with read-only privileges can cause the mongod process to terminate abnormally An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency triggered by a specific combination of aggregation opti

CVE-2026-13068 [MEDIUM] CWE-863 CVE-2026-13068: An authenticated user holding cursor termination privileges on one database may incorrectly be permi An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace.

CVE-2026-18707 [MEDIUM] CWE-617 CVE-2026-18707: An issue in MongoDB Server could allow an authenticated user, including one with no assigned privile An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.

CVE-2026-13061 [MEDIUM] CWE-863 CVE-2026-13061: An authenticated user may be able to view session metadata belonging to other users on the system th An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.