MongoDB | Alerts

Use-after-free in the MongoDB server query planner may lead to crash or undefined behavior (CVE-2025-11979)

Mon, 20 Oct 2025 17:47:57 GMT

An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0.

CVSS Score has been rated as 5.3

Configuration may unexpectedly disable certificate validation (CVE-2025-11695)

Mon, 13 Oct 2025 16:22:57 GMT

When tlsInsecure=False appears in a connection string, certificate validation is disabled.This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5

CVSS Score has been rated as 8

MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories (CVE-2025-11535)

Wed, 08 Oct 2025 22:07:18 GMT

MongoDB Connector for BI installation viaMSIon Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24.

CVSS Score has been rated as

MongoDB Windows installation MSI may leave ACLs unset on custom installation directories (CVE-2025-10491)

Mon, 15 Sep 2025 16:04:54 GMT

The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5

CVSS Score has been rated as 7.8

Malformed $group Query May Cause MongoDB Server to Crash (CVE-2025-10061)

Fri, 05 Sep 2025 20:48:25 GMT

An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This vulnerability could lead to denial of service if triggered repeatedly. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22, MongoDB Server v8.0 versions prior to 8.0.12 and MongoDB Server v8.1 versions prior to 8.1.2

CVSS Score has been rated as 6.5

MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation (CVE-2025-10060)

Fri, 05 Sep 2025 20:39:14 GMT

MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22 and MongoDB Server v8.0 versions prior to 8.0.12

CVSS Score has been rated as 6.5

MongoDB Server router will crash when incorrect lsid is set on a sharded query (CVE-2025-10059)

Fri, 05 Sep 2025 20:26:52 GMT

An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. This affects MongoDB Server v6.0 versions prior to 6.0.x, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v8.0 versions prior to 8.0.6.

CVSS Score has been rated as 6.5

Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections (CVE-2025-6714)

Mon, 07 Jul 2025 14:48:48 GMT

MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured with load balancer support. This issue affects MongoDB Server v6.0 prior to 6.0.23, MongoDB Server v7.0 prior to 7.0.20 and MongoDB Server v8.0 prior to 8.0.9Required Configuration:This affects MongoDB sharded clusters when configured with load balancer support for mongos using HAProxy on specified ports.

CVSS Score has been rated as 7.5

MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage (CVE-2025-6713)

Mon, 07 Jul 2025 14:46:36 GMT

An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This issue affects MongoDB Server MongoDB Server v8.0 versions prior to 8.0.7, MongoDB Server v7.0 versions prior to 7.0.20 and MongoDB Server v6.0 versions prior to 6.0.22

CVSS Score has been rated as 7.7

MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation (CVE-2025-6712)

Mon, 07 Jul 2025 14:44:38 GMT

MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in memory management related to internal operations. In scenarios where certain internal processes persist longer than anticipated, memory consumption can increase, potentially impacting server stability and availability. This issue affects MongoDB Server v8.0 versions prior to 8.0.10

CVSS Score has been rated as 6.5

Incomplete Redaction of Sensitive Information in MongoDB Server Logs (CVE-2025-6711)

Mon, 07 Jul 2025 14:42:16 GMT

An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0 versions prior to 8.0.5, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v6.0 versions prior to 6.0.21.

CVSS Score has been rated as 4.4

Certain Queries with Duplicate _id Fields May Cause MongoDB Server to Crash (CVE-2025-7259)

Mon, 07 Jul 2025 15:59:01 GMT

An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can only be triggered by authorized users and cause Denial of Service. This issue affects MongoDB Server v8.1 version 8.1.0.

CVSS Score has been rated as 6.5

Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB (CVE-2025-6710)

Thu, 26 Jun 2025 14:09:29 GMT

MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the server to crash which could occur pre-authorisation. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5.The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating.

CVSS Score has been rated as 7.5

Kubernetes Operator generates potentially insecure certificates (CVE-2020-7922)

Thu, 09 Apr 2020 00:00:00 GMT

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates are unaffected. This issue affects: MongoDB Inc. MongoDB Enterprise Kubernetes Operator version 1.0, 1.1, 1.2 versions prior to 1.2.4, 1.3 versions prior to 1.3.1, 1.2, 1.4 versions prior to 1.4.4.

CVSS Score has been rated as 6.4

Race condition in privilege cache invalidation cycle (CVE-2025-6707)

Thu, 26 Jun 2025 14:04:46 GMT

Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5.

CVSS Score has been rated as 4.2

Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server (CVE-2025-6706)

Thu, 26 Jun 2025 14:00:22 GMT

An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server.The crash is triggered on affected versions by issuing an aggregation framework operation using a specific combination of rarely-used aggregation pipeline expressions. This issue affects MongoDB Server v6.0 version prior to 6.0.21, MongoDB Server v7.0 version prior to 7.0.17 and MongoDB Server v8.0 version prior to 8.0.4 when the SBE engine is enabled.

CVSS Score has been rated as 5

MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked (CVE-2025-3085)

Tue, 01 Apr 2025 12:05:05 GMT

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-cluster authentication. This issue affects MongoDB Server v5.0 versions prior to 5.0.31, MongoDB Server v6.0 versions prior to 6.0.20, MongoDB Server v7.0 versions prior to 7.0.16 and MongoDB Server v8.0 versions prior to 8.0.4.Required Configuration :MongoDB Server must be running on Linux Operating Systems and CRL revocation status checking must be enabled

CVSS Score has been rated as 8.1

MongoDB Server may crash due to improper validation of explain command (CVE-2025-3084)

Tue, 01 Apr 2025 11:14:19 GMT

When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4

CVSS Score has been rated as 6.5

User may override a view's collation and gain unauthorized access to underlying data (CVE-2025-3082)

Tue, 01 Apr 2025 11:08:06 GMT

A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version prior to 7.0.14 and MongoDB Server v7.3 versions prior to 7.3.4.

CVSS Score has been rated as 3.1

Malformed MongoDB wire protocol messages may cause mongos to crash (CVE-2025-3083)

Tue, 01 Apr 2025 11:12:31 GMT

Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to6.0.20 and MongoDB v7.0 versions prior to 7.0.16

CVSS Score has been rated as 7.5

MongoDB C Driver bson library may be susceptible to buffer overflow (CVE-2025-0755)

Tue, 18 Mar 2025 09:01:04 GMT

The various bson_appendfunctions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16

CVSS Score has been rated as 8.4

MongoDB Shell may be susceptible to local privilege escalation in Windows (CVE-2025-1756)

Thu, 27 Feb 2025 15:28:11 GMT

mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules. This issue affects mongosh prior to 2.3.0

CVSS Score has been rated as 7.5

MongoDB Compass may be susceptible to local privilege escalation in Windows (CVE-2025-1755)

Thu, 27 Feb 2025 15:24:07 GMT

MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in C:\node_modules. This issue affects MongoDB Compass prior to 1.42.1

CVSS Score has been rated as 7.5

MongoDB Shell may be susceptible to control character Injection via shell output (CVE-2025-1693)

Thu, 27 Feb 2025 12:39:37 GMT

The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages that appear to originate from mongosh or the underlying operating system, potentially misleading users into executing unsafe actions.The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.This issue affects mongosh versions prior to 2.3.9

CVSS Score has been rated as 3.9

MongoDB Shell may be susceptible to control character injection via pasting (CVE-2025-1692)

Thu, 27 Feb 2025 12:37:00 GMT

The MongoDB Shell may be susceptible to control character injection where an attacker with control of the users clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9

CVSS Score has been rated as 6.3

MongoDB Shell may be susceptible to Control Character Injection via autocomplete (CVE-2025-1691)

Thu, 27 Feb 2025 12:34:02 GMT

The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user interaction in the form of the user using tab to autocomplete text that is a prefix of the attackers prepared autocompletion. This issue affects mongosh versions prior to2.3.9.The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.

CVSS Score has been rated as 7.6

Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server (CVE-2024-10921)

Thu, 14 Nov 2024 16:04:04 GMT

An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.

CVSS Score has been rated as 6.8

CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines (CVE-2024-8013)

Mon, 28 Oct 2024 12:58:05 GMT

A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.

CVSS Score has been rated as 2.2

Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication (CVE-2025-6709)

Thu, 26 Jun 2025 14:07:04 GMT

The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using the mongo shell to send a malicious JSON payload leading to an invariant failure and server crash. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5.The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating.

CVSS Score has been rated as 7.5

Flaw in the updateUser Command May Allow Unauthorized Configuration Change (CVE-2026-6915)

Wed, 29 Apr 2026 16:51:01 GMT

An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account.

CVSS Score has been rated as 5.3

MD5 checksum creation may cause availability loss (CVE-2026-6914)

Wed, 29 Apr 2026 16:47:02 GMT

Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server.This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server v7.0 versions prior to 7.0.32

CVSS Score has been rated as 7.1

bson_validate may skip validation when processing certain inputs (CVE-2026-6231)

Mon, 13 Apr 2026 15:31:55 GMT

The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data before further processing. This issue affects MongoDB C Driver versions prior to 1.30.5, MongoDB C Driver version 2.0.0 and MongoDB C Driver version 2.0.1

CVSS Score has been rated as 5.3

Users could trigger a crash of mongod primaries during promotion to sharded (CVE-2026-5170)

Mon, 30 Mar 2026 15:28:57 GMT

A user with access to the cluster with a limited set of privilege actions can trigger a crash of amongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set.This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.

CVSS Score has been rated as 6

Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer (CVE-2026-4359)

Tue, 17 Mar 2026 19:42:03 GMT

A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.

CVSS Score has been rated as 2

Memory safety issues in slot-based execution hash table spill (CVE-2026-4358)

Tue, 17 Mar 2026 19:00:07 GMT

A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.

CVSS Score has been rated as 6.1

ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators (CVE-2026-4148)

Tue, 17 Mar 2026 15:53:57 GMT

A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.

CVSS Score has been rated as 8.7

Stack memory disclosure in filemd5 command (CVE-2026-4147)

Tue, 17 Mar 2026 15:50:21 GMT

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.

CVSS Score has been rated as 7.1

Integer Overflow in GridFS chunkSize Leading to Heap Allocation Failure (CVE-2025-14911)

Tue, 27 Jan 2026 17:29:21 GMT

User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overflow the bounding container.

CVSS Score has been rated as 7.1

MongoDB Server may crash when inserting large documents (CVE-2026-1847)

Tue, 10 Feb 2026 18:16:24 GMT

Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the oplog from the primary. This could stall replication inside the replica set leading to server crash.

CVSS Score has been rated as 7.1

Connections received from the proxy port may not count towards total accepted connections (CVE-2026-1848)

Tue, 10 Feb 2026 18:22:41 GMT

Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header.

CVSS Score has been rated as 8.2

Mongod can run out of stack memory when expressions create deeply nested documents (CVE-2026-1849)

Tue, 10 Feb 2026 18:52:52 GMT

MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.

CVSS Score has been rated as 7.1

An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification (CVE-2026-1850)

Tue, 10 Feb 2026 18:49:32 GMT

Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash.

CVSS Score has been rated as 7.1

Invalid $geoNear index hint may cause server crash (CVE-2026-25610)

Tue, 10 Feb 2026 18:30:40 GMT

An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.

CVSS Score has been rated as 7.1

MongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directories (CVE-2025-11575)

Thu, 23 Oct 2025 00:22:00 GMT

Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects MongoDB Atlas SQL ODBC driver: from 1.0.0 through 2.0.0.

CVSS Score has been rated as

An unsafe cast in the MongoDB query planner can result in a segmentation fault. (CVE-2026-25613)

Tue, 10 Feb 2026 18:54:50 GMT

An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.

CVSS Score has been rated as 7.1

Internal ResourceId collision may affect unrelated collections (CVE-2026-25612)

Tue, 10 Feb 2026 18:05:23 GMT

The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conflicting locks.

CVSS Score has been rated as 7.1

Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server (CVE-2026-25611)

Tue, 10 Feb 2026 17:52:47 GMT

A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.

CVSS Score has been rated as 8.7

Unsafe Reflection in Mongoid::Criteria.from_hash (CVE-2026-2302)

Tue, 10 Feb 2026 18:59:23 GMT

Under specific conditions when processing a maliciously crafted value of type Hash r, Mongoid::Criteria.from_hash may allow for executing arbitrary Ruby code.

CVSS Score has been rated as 6.9

Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak (CVE-2026-2303)

Tue, 10 Feb 2026 19:03:06 GMT

The mongo-go-driver repositorycontains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.

CVSS Score has been rated as 6.9

Zlib compressed protocol header length confusion may allow memory read (CVE-2025-14847)

Fri, 19 Dec 2025 11:00:22 GMT

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

CVSS Score has been rated as 8.7

Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server (CVE-2025-14345)

Tue, 09 Dec 2025 15:00:38 GMT

A post-authenticationflaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact.This issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 versions prior to 8.2.2.

CVSS Score has been rated as 4.2

MongoDB may be susceptible to Invariant Failure due to batched delete (CVE-2025-13644)

Tue, 25 Nov 2025 05:23:12 GMT

MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the server mistakenly assumes the presence of multiple documents in a batch based solely on document size exceeding BSONObjMaxSize. This issue affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.13, and MongoDB Server v8.1 versions prior to 8.1.2

CVSS Score has been rated as 6.5

MongoDB Server may allow queries to be terminated by unauthorized users (CVE-2025-13643)

Tue, 25 Nov 2025 05:16:24 GMT

A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. This issue affects MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB Server v8.0 versions prior to 8.0.14

CVSS Score has been rated as 3.1

Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server (CVE-2025-12893)

Tue, 25 Nov 2025 05:07:17 GMT

Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems.Additionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. This vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2

CVSS Score has been rated as 4.2

Time-series operations may cause internal BSON size limit to be exceed (CVE-2025-13507)

Tue, 25 Nov 2025 04:52:47 GMT

Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and process termination. This issue impacts MongoDB Server v7.0 versions prior to 7.0.26, v8.0 versions prior to 8.0.16 and MongoDB server v8.2 versions prior to 8.2.1.

CVSS Score has been rated as 7.1

Bulk write with options may read invalid memory (CVE-2025-12119)

Tue, 18 Nov 2025 20:21:08 GMT

A mongoc_bulk_operation_t may read invalid memory if large options are passed.

CVSS Score has been rated as

Malformed KMIP response may result in access violation (CVE-2025-12657)

Mon, 03 Nov 2025 21:03:25 GMT

The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations.

CVSS Score has been rated as

MongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directories (CVE-2025-12100)

Thu, 23 Oct 2025 21:02:18 GMT

Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue affects BI Connector ODBC driver: from 1.0.0 through 1.4.6.

CVSS Score has been rated as

profile command may permit unauthorized configuration (CVE-2026-25609)

Tue, 10 Feb 2026 18:39:11 GMT

Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.

CVSS Score has been rated as 5.3

MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an application (CVE-2021-20331)

Mon, 24 May 2021 00:00:00 GMT

Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver 2.12 <= 2.12.1.

CVSS Score has been rated as 4.2

Specially crafted query may result in a denial of service of mongod (CVE-2021-20326)

Fri, 30 Apr 2021 00:00:00 GMT

A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.4.

CVSS Score has been rated as 6.5

Specific command line parameter might result in accepting invalid certificate (CVE-2020-7924)

Mon, 12 Apr 2021 00:00:00 GMT

Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions later than 3.6.5; 3.6 versions prior to 3.6.21; 4.0 versions prior to 4.0.21; 4.2 versions prior to 4.2.11; 100 versions prior to 100.2.0. MongoDB Inc. Mongomirror 0 versions later than 0.6.0.

CVSS Score has been rated as 4.2

Local privilege escalation in MongoDB Compass for Windows (CVE-2021-20334)

Tue, 06 Apr 2021 00:00:00 GMT

A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x versions prior to 1.25.0 on Windows.

CVSS Score has been rated as 4.8

Invariant failure when explaining a find with a UUID (CVE-2018-25004)

Fri, 26 Feb 2021 00:00:00 GMT

A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.6; MongoDB Server v3.6 versions prior to 3.6.11.

CVSS Score has been rated as 4.9

Specially crafted regex query can cause DoS (CVE-2020-7929)

Fri, 26 Feb 2021 00:00:00 GMT

A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects: MongoDB Inc. MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20.

CVSS Score has been rated as 6.5

MongoDB Java driver client-side field level encryption not verifying KMS host name (CVE-2021-20328)

Thu, 25 Feb 2021 00:00:00 GMT

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS servers certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that dont use Field Level Encryption.

CVSS Score has been rated as 6.4

MongoDB Node.js client side field level encryption library may not be validating KMS certificate (CVE-2021-20327)

Thu, 25 Feb 2021 00:00:00 GMT

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS servers certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This issue was discovered during internal testing and affects mongodb-client-encryption module version 1.2.0, which was available from 2021-Jan-29 and deprecated in the NPM Registry on 2021-Feb-04. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services from applications residing inside the AWS, GCP, and Azure nework fabrics due to compensating controls in these environments. This issue does not impact driver workloads that dont use Field Level Encryption.

CVSS Score has been rated as 6.4

SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager (CVE-2021-20335)

Thu, 11 Feb 2021 00:00:00 GMT

For MongoDB Ops Manager <= 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager <= 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. This issue is temporary and eventually corrects itself after MongoDB Ops Manager instances have finished upgrading to MongoDB Ops Manager 4.4. In addition, customers must be running with clientCertificateMode=OPTIONAL / allowConnectionsWithoutCertificates=true to be impacted*.* Customers upgrading from Ops Manager 4.2.X to 4.2.24 and finally to Ops Manager 4.4.13+ are unaffected by this issue.

CVSS Score has been rated as 6.7

Infinite loop in aggregation expression (CVE-2018-20803)

Mon, 23 Nov 2020 00:00:00 GMT

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining locks. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.5; v3.6 versions prior to 3.6.10; v3.4 versions prior to 3.4.19.

CVSS Score has been rated as 6.5

Denial of service via malformed network packet (CVE-2019-20925)

Tue, 24 Nov 2020 00:00:00 GMT

An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects: MongoDB Inc. MongoDB Server v4.2 versions prior to 4.2.1; v4.0 versions prior to 4.0.13; v3.6 versions prior to 3.6.15; v3.4 versions prior to 3.4.24.

CVSS Score has been rated as 7.5

Invariant with $elemMatch (CVE-2018-20805)

Mon, 30 Nov 2020 00:00:00 GMT

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.5; v3.6 versions prior to 3.6.10. This issue affects: MongoDB Inc. MongoDB Server 3.6 versions prior to 3.6.10; 4.0 versions prior to 4.0.5.

CVSS Score has been rated as 6.5

Invariant failure in applyOps (CVE-2018-20804)

Mon, 30 Nov 2020 00:00:00 GMT

A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.10; v3.6 versions prior to 3.6.13.

CVSS Score has been rated as 6.5

Post-auth queries on compound index may crash mongod (CVE-2018-20802)

Mon, 30 Nov 2020 00:00:00 GMT

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects: MongoDB Inc. MongoDB Server v3.6 versions prior to 3.6.9, v4.0 versions prior to 4.0.3.

CVSS Score has been rated as 6.5

MongoDB Server secondaries may crash due to forced index constraints (CVE-2024-8305)

Mon, 21 Oct 2024 14:10:31 GMT

prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB Server v7.0 versions prior to 7.0.13 and MongoDB Server v7.3 versions prior to 7.3.4

CVSS Score has been rated as 6.5

Invariant in IndexBoundsBuilder (CVE-2019-20924)

Tue, 01 Dec 2020 00:00:00 GMT

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsBuilder. This issue affects: MongoDB Inc. MongoDB Server v4.2 versions prior to 4.2.2.

CVSS Score has been rated as 6.5

Crash while handling internal Javascript exception types (CVE-2019-20923)

Mon, 30 Nov 2020 00:00:00 GMT

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.7.

CVSS Score has been rated as 6.5

Crash while joining collections with $lookup (CVE-2019-2393)

Mon, 30 Nov 2020 00:00:00 GMT

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use $lookup and collations. This issue affects: MongoDB Inc. MongoDB Server v4.2 versions prior to 4.2.1; v4.0 versions prior to 4.0.13; v3.6 versions prior to 3.6.15.

CVSS Score has been rated as 6.5

$mod can result in UB (CVE-2019-2392)

Mon, 30 Nov 2020 00:00:00 GMT

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overflow negative values. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9; v4.0 versions prior to 4.0.20; v3.6 versions prior to 3.6.20.

CVSS Score has been rated as 6.5

Potential privilege escalation in Ops Manager API (CVE-2020-7927)

Mon, 30 Nov 2020 00:00:00 GMT

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions 4.2.0-4.2.17, v4.3 versions 4.3.0-4.3.9 and v4.4 versions 4.4.0-4.4.2.

CVSS Score has been rated as 8.1

Specific query can cause a DoS against MongoDB Server (CVE-2020-7926)

Mon, 30 Nov 2020 00:00:00 GMT

A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant in the server selection subsystem. This issue affects: MongoDB Server version 4.4 prior to 4.4.1. Versions before 4.4 are not affected.

CVSS Score has been rated as 6.5

Denial of Service when processing malformed Role names (CVE-2020-7925)

Mon, 30 Nov 2020 00:00:00 GMT

Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.0-rc12; v4.2 versions prior to 4.2.9.

CVSS Score has been rated as 7.5

Specific GeoQuery can cause DoS against MongoDB Server (CVE-2020-7923)

Fri, 21 Aug 2020 00:00:00 GMT

A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.0-rc7; v4.2 versions prior to 4.2.8; v4.0 versions prior to 4.0.19.

CVSS Score has been rated as 6.5

Code execution on Windows via OpenSSL engine injection (CVE-2019-2390)

Fri, 30 Aug 2019 11:00:00 GMT

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue affects: MongoDB Inc. MongoDB Server 4.0 prior to 4.0.11; 3.6 prior to 3.6.14; 3.4 prior to 3.4.22.

CVSS Score has been rated as 8.2

Authorization session conflation (CVE-2019-2386)

Tue, 06 Aug 2019 11:00:00 GMT

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.9; v3.6 versions prior to 3.6.13; v3.4 versions prior to 3.4.22.

CVSS Score has been rated as 7.1

JS-bson may incorrectly serialise some requests (CVE-2019-2391)

Tue, 31 Mar 2020 11:00:00 GMT

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.

CVSS Score has been rated as 4.2

Potential exposure of log information in Ops Manager (CVE-2019-2388)

Wed, 13 May 2020 11:00:00 GMT

In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5.

CVSS Score has been rated as 5.8

Process termination via PID file manipulation (CVE-2019-2389)

Fri, 30 Aug 2019 11:00:00 GMT

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.11; v3.6 versions prior to 3.6.14; v3.4 versions prior to 3.4.22.

CVSS Score has been rated as 5.3

Administrative action may disable enforcement of per-user IP whitelisting (CVE-2020-7921)

Wed, 06 May 2020 11:00:00 GMT

Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to bypass IP whitelisting protection mechanisms following administrative action. This issue affects: MongoDB Inc. MongoDB Server 4.2 versions prior to 4.2.3; 4.0 versions prior to 4.0.15; 4.3 versions prior to 4.3.3; 3.6 versions prior to 3.6.18.

CVSS Score has been rated as 4.6

Improper neutralization of null byte leads to read overrun (CVE-2020-7928)

Mon, 23 Nov 2020 00:00:00 GMT

A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9; v4.0 versions prior to 4.0.20; v3.6 versions prior to 3.6.20.

CVSS Score has been rated as 6.5

MongoDB Server may access non-initialized region of memory leading to unexpected behaviour (CVE-2024-8654)

Tue, 10 Sep 2024 13:35:50 GMT

MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3.

CVSS Score has been rated as 5

MongoDB Server binaries may load potentially insecure shared libraries from specific relative paths (CVE-2024-8207)

Tue, 27 Aug 2024 11:28:06 GMT

In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for a unintended actor with host-level access to cause the MongoDB Server binary to load unintended actor-controlled shared libraries when the server binary is started, potentially resulting in the unintended actor gaining full control over the MongoDB server process. This issue affects MongoDB Server v5.0 versions prior to 5.0.14 and MongoDB Server v6.0 versions prior to 6.0.3.Required Configuration: Only environments with Linux as the underlying operating system is affected by this issue

CVSS Score has been rated as 6.4

Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server (CVE-2024-6384)

Tue, 13 Aug 2024 14:22:22 GMT

"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.3

CVSS Score has been rated as 5.3

Accessing Untrusted Directory May Allow Local Privilege Escalation (CVE-2024-7553)

Wed, 07 Aug 2024 09:57:49 GMT

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1.Required Configuration:Only environments with Windows as the underlying operating system is affected by this issue

CVSS Score has been rated as 7.3

MongoDB C Driver bson_string_append may be vulnerable to a buffer overflow (CVE-2024-6383)

Wed, 03 Jul 2024 21:33:47 GMT

The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1

CVSS Score has been rated as 5.3

Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands. (CVE-2024-6382)

Tue, 02 Jul 2024 17:17:50 GMT

Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2

CVSS Score has been rated as 6.4

MongoDB C Driver bson_strfreev may be susceptible to integer overflow (CVE-2024-6381)

Tue, 02 Jul 2024 17:14:48 GMT

The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative offset. This may result in memory corruption. This issue affected libbson versions prior to 1.26.2

CVSS Score has been rated as 4

Missing authorization check may lead to shard key refinement (CVE-2024-6375)

Mon, 01 Jul 2024 14:40:32 GMT

A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, prior to 5.0.22, MongoDB Server v6.0 versions, prior to 6.0.11 and MongoDB Server v7.0 versions prior to 7.0.3.

CVSS Score has been rated as 5.4

ejson shell parser in MongoDB Compass maybe bypassed (CVE-2024-6376)

Mon, 01 Jul 2024 14:57:31 GMT

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2

CVSS Score has been rated as 7

Out-of-bounds read in bson module of PyMongo (CVE-2024-5629)

Wed, 05 Jun 2024 14:32:56 GMT

An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.

CVSS Score has been rated as 4.7

MongoDB Server may have unexpected application behaviour due to invalid BSON (CVE-2024-3372)

Tue, 14 May 2024 13:24:05 GMT

Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause unexpected application behavior including unavailability of serverStatus responses. This issue affects MongoDB Server v7.0 versions prior to 7.0.6, MongoDB Server v6.0 versions prior to 6.0.14 and MongoDB Server v.5.0 versions prior to 5.0.25.

CVSS Score has been rated as 7.5

MongoDB Server (mongod) may crash when generating ftdc (CVE-2024-3374)

Tue, 14 May 2024 13:26:42 GMT

An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.16 and MongoDB Server v6.0 versions prior to and including 6.0.5.

CVSS Score has been rated as 5.3

Insufficient validation of external input in Compass may enable MITM attacks (CVE-2024-3371)

Wed, 24 Apr 2024 16:32:07 GMT

MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.

CVSS Score has been rated as 7.1

Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application (CVE-2021-32050)

Tue, 29 Aug 2023 15:24:30 GMT

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed.Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default).This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).

CVSS Score has been rated as 4.2

Specific cstrings input may not be properly validated in the Go Driver (CVE-2021-20329)

Thu, 10 Jun 2021 00:00:00 GMT

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers up to (and including) 1.5.0.

CVSS Score has been rated as 6.8

MongoDB client C Driver may infinitely loop when validating certain BSON input data (CVE-2023-0437)

Fri, 12 Jan 2024 14:13:00 GMT

When calling bson_utf8_validateon some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.

CVSS Score has been rated as 5.3

Secret logging may occur in debug mode of Atlas Operator (CVE-2023-0436)

Tue, 07 Nov 2023 12:41:00 GMT

The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.0, 1.6.1, 1.7.0.Please note that this is reported on an EOL version of the product, and users are advised to upgrade to the latest supported version.Required Configuration:DEBUG logging is not enabled by default, and must be configured by the end-user. To check the log-level of the Operator, review the flags passed in your deployment configuration (eg. https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 https://github.com/mongodb/mongodb-atlas-kubernetes/blob/main/config/manager/manager.yaml#L27 )

CVSS Score has been rated as 4.5

Certificate validation issue in MongoDB Server running on Windows or macOS (CVE-2023-1409)

Wed, 23 Aug 2023 16:18:00 GMT

If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in effect, potentially allowing client to establish a TLS connection with the server that supplies any certificate.This issue affect all MongoDB Server v6.3 versions, MongoDB Server v5.0 versions v5.0.0 to v5.0.14 and all MongoDB Server v4.4 versions.

CVSS Score has been rated as 5.3

Privilege Escalation for Project Owner and Project User Admin Roles in Ops Manager (CVE-2023-4009)

Tue, 08 Aug 2023 10:30:00 GMT

In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.

CVSS Score has been rated as 7.2

Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution (CVE-2022-48282)

Tue, 21 Feb 2023 19:39:00 GMT

Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0Following configuration must be true for the vulnerability to be applicable: * Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND * Application must be running on a Windows host using the full .NET Framework, not .NET Core AND * Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND * Malicious attacker must have unrestricted insert access to target database to add a _t discriminator."Following configuration must be true for the vulnerability to be applicable

CVSS Score has been rated as 6.6

MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive (CVE-2023-0342)

Fri, 09 Jun 2023 11:00:00 GMT

MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12

CVSS Score has been rated as 3.1

MongoDB Server (mongod) may crash in response to unexpected requests (CVE-2022-24272)

Wed, 11 May 2022 00:00:00 GMT

An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mongod denial of service or server crash. This issue affects: MongoDB Inc. MongoDB Server v5.0 versions, prior to and including v5.0.6.

CVSS Score has been rated as 6.5

Large aggregation pipelines with a specific stage can crash mongod under default configuration (CVE-2021-32040)

Tue, 12 Apr 2022 00:00:00 GMT

It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the size of the stack frames used by that stage. If an attacker could cause such an aggregation to occur, they could maliciously crash MongoDB in a DoS attack. This vulnerability affects MongoDB versions prior to 5.0.4, 4.4.11, 4.2.16.

CVSS Score has been rated as 6.5

Denial of Service and Data Integrity vulnerability in features command (CVE-2021-32036)

Fri, 04 Feb 2022 00:00:00 GMT

An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions.

CVSS Score has been rated as 5.4

MongoDB Extension for VS Code may unexpectedly store credentials locally in clear text (CVE-2021-32039)

Thu, 20 Jan 2022 00:00:00 GMT

Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension for VS Code including and prior to version 0.7.0

CVSS Score has been rated as 5.5

Specific replication command with malformed oplog entries can crash secondaries (CVE-2021-20330)

Wed, 15 Dec 2021 00:00:00 GMT

An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.25; MongoDB Server v4.2 versions prior to 4.2.14; MongoDB Server v4.4 versions prior to 4.4.6.

CVSS Score has been rated as 6.5

User may trigger invariant when allowed to send commands directly to shards (CVE-2021-32037)

Wed, 24 Nov 2021 00:00:00 GMT

An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard. Usually, the requests are sent via mongos and special privileges are required in order to know the address of the shards and to log in to the shards of an auth enabled environment.

CVSS Score has been rated as 6.5

MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an application (CVE-2021-20332)

Mon, 02 Aug 2021 00:00:00 GMT

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credentials. Note that such monitoring is not enabled by default.

CVSS Score has been rated as 4.2

Server log entry spoofing via newline injection (CVE-2021-20333)

Fri, 23 Jul 2021 00:00:00 GMT

Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21; MongoDB Server v4.2 versions prior to 4.2.10;

CVSS Score has been rated as 5.3

MongoDB Server may allow successful untrusted connection (CVE-2024-1351)

Thu, 07 Mar 2024 09:31:00 GMT

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28.Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.

CVSS Score has been rated as 8.8

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver (CVE-2026-81524)

Thu, 27 Aug 2026 18:32:25 GMT

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.

CVSS Score has been rated as 5.3

Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt (CVE-2026-81523)

Thu, 27 Aug 2026 18:32:24 GMT

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.

CVSS Score has been rated as 2

Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver (CVE-2026-81521)

Thu, 27 Aug 2026 18:31:45 GMT

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

CVSS Score has been rated as 7.1

MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character data (CVE-2026-18888)

Wed, 12 Aug 2026 20:29:33 GMT

The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.

CVSS Score has been rated as 7.1

Insufficient OIDC endpoint validation could invoke unintended local protocol handlers (CVE-2026-19503)

Wed, 12 Aug 2026 20:17:55 GMT

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.

CVSS Score has been rated as 6.3

Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI (CVE-2026-19502)

Wed, 12 Aug 2026 20:14:33 GMT

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.

CVSS Score has been rated as 6.8

MongoDB BI Connector ODBC driver may write outside an allocated buffer when the setup dialog opens a data source with oversized path settings (CVE-2026-19003)

Wed, 12 Aug 2026 21:04:19 GMT

A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running the dialog.

CVSS Score has been rated as 8.4

MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters (CVE-2026-19004)

Wed, 12 Aug 2026 20:33:13 GMT

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.

CVSS Score has been rated as 8.8

Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver (CVE-2026-19002)

Wed, 12 Aug 2026 20:24:35 GMT

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.

CVSS Score has been rated as 8.8

MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names (CVE-2026-19001)

Wed, 12 Aug 2026 20:27:02 GMT

The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.

CVSS Score has been rated as 9.5

Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections (CVE-2026-18712)

Tue, 11 Aug 2026 18:49:28 GMT

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.

CVSS Score has been rated as 7.2

Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure (CVE-2026-18711)

Tue, 11 Aug 2026 18:48:50 GMT

An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query results.

CVSS Score has been rated as 7.1

Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization (CVE-2026-18710)

Tue, 11 Aug 2026 22:00:07 GMT

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.

CVSS Score has been rated as 8.2

Schema validation log messages may not redact user data (CVE-2026-8200)

Wed, 13 May 2026 00:08:29 GMT

When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted.This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

CVSS Score has been rated as 4.8

Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes (CVE-2026-18708)

Tue, 11 Aug 2026 18:41:10 GMT

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.

CVSS Score has been rated as 5.3

Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service (CVE-2026-18707)

Tue, 11 Aug 2026 18:34:04 GMT

An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.

CVSS Score has been rated as 5.3

Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution (CVE-2026-18706)

Tue, 11 Aug 2026 18:34:37 GMT

An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.

CVSS Score has been rated as 7.5

Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data (CVE-2026-18705)

Tue, 11 Aug 2026 18:37:54 GMT

An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.

CVSS Score has been rated as 7.1

Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations (CVE-2026-18704)

Tue, 11 Aug 2026 18:37:23 GMT

An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.

CVSS Score has been rated as 7.1

Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method (CVE-2026-18703)

Tue, 11 Aug 2026 18:33:16 GMT

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intended to disable.

CVSS Score has been rated as 2.3

Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings (CVE-2026-18702)

Tue, 11 Aug 2026 18:43:59 GMT

An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitoring by causing excessive log volume.

CVSS Score has been rated as 5.3

Type Confusion in MongoDB Query Subsystem Leads to Denial of Service (CVE-2026-18701)

Tue, 11 Aug 2026 18:39:35 GMT

An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.

CVSS Score has been rated as 7.1

Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service (CVE-2026-18700)

Tue, 11 Aug 2026 18:40:07 GMT

An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service.

CVSS Score has been rated as 6

Improper Input Validation in MongoDB Query Planner Leads to Denial of Service (CVE-2026-18699)

Tue, 11 Aug 2026 18:46:35 GMT

An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connected clients and in-flight operations.

CVSS Score has been rated as 6

Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command (CVE-2026-18698)

Tue, 11 Aug 2026 18:47:34 GMT

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations, unauthorized modification of system collection data.

CVSS Score has been rated as 5.3

Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos (CVE-2026-18697)

Tue, 11 Aug 2026 18:39:03 GMT

An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.

CVSS Score has been rated as 8.7

Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections (CVE-2026-18696)

Tue, 11 Aug 2026 18:40:35 GMT

An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual operation.

CVSS Score has been rated as 7

Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service (CVE-2026-18695)

Tue, 11 Aug 2026 18:35:46 GMT

An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service.

CVSS Score has been rated as 7.1

Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency (CVE-2026-18709)

Tue, 11 Aug 2026 18:48:11 GMT

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.

CVSS Score has been rated as 5.9

Heap out-of-bounds read via corrupt nested BSON in field path error message (CVE-2026-84968)

Thu, 03 Sep 2026 17:03:14 GMT

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.

CVSS Score has been rated as 6.9

Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path (CVE-2026-84971)

Thu, 03 Sep 2026 14:57:35 GMT

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running.

CVSS Score has been rated as 7.1

Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser (CVE-2026-84970)

Thu, 03 Sep 2026 14:56:14 GMT

A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.

CVSS Score has been rated as 5.9

Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output (CVE-2026-84969)

Thu, 03 Sep 2026 14:59:01 GMT

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.

CVSS Score has been rated as 6.3

Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal (CVE-2026-84967)

Thu, 03 Sep 2026 15:18:02 GMT

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-users choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.

CVSS Score has been rated as 5.1

BSON element injection via NUL-embedded document keys in builder append (CVE-2026-84966)

Thu, 03 Sep 2026 15:00:15 GMT

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.

CVSS Score has been rated as 5.9

Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds (CVE-2026-84965)

Thu, 03 Sep 2026 15:01:21 GMT

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.

CVSS Score has been rated as 5.9

Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client (CVE-2026-84964)

Thu, 03 Sep 2026 15:02:20 GMT

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly.

CVSS Score has been rated as 8.2

Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser (CVE-2026-84963)

Thu, 03 Sep 2026 15:03:13 GMT

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.

CVSS Score has been rated as 6.3

Authenticated KMS request forgery via CRLF injection in GCP key identifier strings (CVE-2026-84962)

Thu, 03 Sep 2026 15:03:52 GMT

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

CVSS Score has been rated as 5.7

MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports (CVE-2026-76797)

Fri, 28 Aug 2026 19:24:07 GMT

The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a formula when an operator opens the generated report in a spreadsheet application, which may result in unintended disclosure of report contents or execution of external content on the operator's workstation. Generating a report for the affected namespace and opening it in a spreadsheet application is required.

CVSS Score has been rated as 5.8

MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports (CVE-2026-76798)

Fri, 28 Aug 2026 19:24:46 GMT

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query is interpreted by the browser when an operator later generates and opens the report, which may disclose other users' logged query text and user names to an external party or present misleading content to the operator. Generating a report over logs containing the affected entries and opening that report in a browser is required.

CVSS Score has been rated as 6.9

MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata (CVE-2026-76794)

Fri, 28 Aug 2026 19:23:07 GMT

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report contents or altering its display.

CVSS Score has been rated as 4.8

MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output (CVE-2026-77586)

Fri, 28 Aug 2026 19:26:11 GMT

In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write to a sampled MongoDB collection can choose a name that closes the quoted identifier early, so that additional SQL text becomes part of the generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.

CVSS Score has been rated as 8.5

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver (CVE-2026-81525)

Thu, 27 Aug 2026 18:32:26 GMT

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

CVSS Score has been rated as 8.6

MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values (CVE-2026-81533)

Fri, 28 Aug 2026 20:28:02 GMT

An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length. A user able to influence the numeric portion of a LIMIT clause could cause the hosting application process to terminate unexpectedly or corrupt adjacent memory in that process.

CVSS Score has been rated as 6

BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption (CVE-2026-81532)

Fri, 28 Aug 2026 20:26:05 GMT

A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message, memory adjacent to that buffer is overwritten with user-supplied content. This can terminate the hosting application process and may allow unintended code to run within it.

CVSS Score has been rated as 8.7

BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections (CVE-2026-81518)

Fri, 28 Aug 2026 20:18:14 GMT

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.

CVSS Score has been rated as 8.7

MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion (CVE-2026-81520)

Fri, 28 Aug 2026 20:22:42 GMT

A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions.

CVSS Score has been rated as 8.7

MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service (CVE-2026-81517)

Fri, 28 Aug 2026 20:14:06 GMT

An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operation subsequently fails, the resulting error is not handled and the shared mongosqld process ends, ending service for all connected SQL clients. The process continues to end on startup until an operator restores available storage, and the diagnostic message explaining the condition is not recorded.

CVSS Score has been rated as 8.7

MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service (CVE-2026-81490)

Fri, 28 Aug 2026 20:10:38 GMT

A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message as transient and, after the configured retries are exhausted, proceeds without a valid result, ending the schema refresh routine. The mongosqld process continues running without a usable schema, so SQL clients are unable to obtain results until an operator removes the view or excludes its namespace from sampling.

CVSS Score has been rated as 8.3

MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied (CVE-2026-75573)

Thu, 27 Aug 2026 16:01:55 GMT

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclosed password to access the associated TLS client key.

CVSS Score has been rated as 4.1

MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination (CVE-2026-75159)

Thu, 27 Aug 2026 15:58:38 GMT

An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until the process restarts.

CVSS Score has been rated as 8.2

Connection-option injection via unescaped settings in the canonical MongoDB URL builder (CVE-2026-81529)

Thu, 27 Aug 2026 18:32:31 GMT

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.

CVSS Score has been rated as 7.1

KMS master key exposure via unredacted credential serialization in driver settings string (CVE-2026-81530)

Thu, 27 Aug 2026 18:32:32 GMT

A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked as other secret fields are. A party able to read the application's logs, diagnostic output, or a process memory dump may thereby recover the plaintext credentials and use them to decrypt protected field data.

CVSS Score has been rated as 6.8

Cross-database write redirection via unvalidated dotted database name in bulk write namespaces (CVE-2026-81526)

Thu, 27 Aug 2026 18:32:27 GMT

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application's own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application.

CVSS Score has been rated as 7.1

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver (CVE-2026-81522)

Thu, 27 Aug 2026 18:32:23 GMT

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

CVSS Score has been rated as 8.6

NoSQL injection via array replacement bypassing update shape validation in driver write path (CVE-2026-81528)

Thu, 27 Aug 2026 18:32:30 GMT

A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.

CVSS Score has been rated as 5.3

NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation (CVE-2026-81527)

Thu, 27 Aug 2026 18:32:28 GMT

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered.

CVSS Score has been rated as 6.9

MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output (CVE-2026-77184)

Fri, 28 Aug 2026 19:25:23 GMT

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in deployments configured to build their SQL schema from those validators, can cause additional SQL text to be embedded in that generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.

CVSS Score has been rated as 5.6

Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow (CVE-2026-14881)

Wed, 22 Jul 2026 19:23:17 GMT

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.

CVSS Score has been rated as 8.4

Find command with $meta sort can lead to crash (CVE-2026-9737)

Wed, 22 Jul 2026 19:20:40 GMT

During query planning when reading the sort pattern in raw BSONObj form, in some places we dont explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.

CVSS Score has been rated as 7.1

Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion (CVE-2026-11933)

Fri, 12 Jun 2026 01:57:32 GMT

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.

CVSS Score has been rated as 8.8

Stack memory disclosure in filemd5 command (CVE-2026-9754)

Tue, 09 Jun 2026 22:33:21 GMT

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command

CVSS Score has been rated as 7.1

Server crash via malformed binary diff passed to $_internalApplyOplogUpdate. (CVE-2026-9753)

Tue, 09 Jun 2026 22:30:57 GMT

The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.

CVSS Score has been rated as 7.2

GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation (CVE-2026-9752)

Tue, 09 Jun 2026 22:27:49 GMT

An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS.Strict-winding polygons are intentionally unsupported for indexing, but the guard that rejects them does not inspect members of a GeometryCollection, allowing the unsafe path to be reached which ends with an ensuing null-pointer dereference.

CVSS Score has been rated as 7.1

Sensitive data could be written to mongod.log (CVE-2026-9751)

Tue, 09 Jun 2026 22:24:25 GMT

The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.

CVSS Score has been rated as 6.8

Metadata name collision on $-prefixed fields causes post-auth server crash (CVE-2026-9750)

Tue, 09 Jun 2026 22:17:08 GMT

An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document fields and internal metadata in certain execution paths.

CVSS Score has been rated as 7.1

Using MaxKey() may crash the server (CVE-2026-9749)

Tue, 09 Jun 2026 22:10:45 GMT

This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer (that is, many results are routed to the same consumer), the server reaches the code path where a full per-consumer buffer is detected but the internal "high watermark" for that key range is not updated as intended.

CVSS Score has been rated as 7.1

$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input (CVE-2026-9748)

Tue, 09 Jun 2026 22:08:22 GMT

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.

CVSS Score has been rated as 7.1

Crafted cross-shard merge aggregation crashes MongoDB Server (CVE-2026-9747)

Tue, 09 Jun 2026 22:05:24 GMT

Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.

CVSS Score has been rated as 7.1

Server crashes in case of the use of exchange (CVE-2026-9746)

Tue, 09 Jun 2026 22:02:12 GMT

When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement.

CVSS Score has been rated as 7.1

Aggregation sub-pipeline null dereference may allow DoS via crafted getMore (CVE-2026-9743)

Tue, 09 Jun 2026 21:59:34 GMT

In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.

CVSS Score has been rated as 7.1

Authenticate command with specific mechanism parameter can trigger server crash (CVE-2026-9742)

Tue, 09 Jun 2026 21:57:46 GMT

When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.

CVSS Score has been rated as 8.2

Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure (CVE-2026-18694)

Tue, 11 Aug 2026 18:42:43 GMT

An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memory outside its intended bounds. This could result in a server crash (denial of service) and may expose a limited amount of server process memory.

CVSS Score has been rated as 7.1

Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow (CVE-2026-9740)

Tue, 09 Jun 2026 22:43:44 GMT

A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.

CVSS Score has been rated as 8.7

Keyfile contents are in MongoDB Server logs (CVE-2026-9735)

Tue, 09 Jun 2026 22:40:55 GMT

MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.

CVSS Score has been rated as 6.8

Prototype pollution in csv parsing (CVE-2026-9101)

Wed, 20 May 2026 16:18:10 GMT

Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.

CVSS Score has been rated as 5.3

Heap memory out of bounds read and crash in C Driver legacy GridFS file reader (CVE-2026-9100)

Wed, 20 May 2026 15:55:13 GMT

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

CVSS Score has been rated as 6

Calling createIndex with certain index types can crash mongod (CVE-2026-8843)

Mon, 18 May 2026 15:40:06 GMT

Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices.This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6

CVSS Score has been rated as 7.1

PHP Stack Exhaustion (CVE-2026-6811)

Thu, 14 May 2026 21:27:03 GMT

Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.

CVSS Score has been rated as 6

MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow (CVE-2026-6691)

Wed, 06 May 2026 15:08:23 GMT

The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI.

CVSS Score has been rated as 8.6

Post-auth null pointer dereference when aggregating against a view with empty search pipeline (CVE-2026-8063)

Thu, 07 May 2026 04:12:54 GMT

An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view.When resolving a view, the server inspects the aggregation pipeline to determine whether it begins with an Atlas Search stage. For $rankFusion and $scoreFusion, this inspection reads the first element on each stages input pipeline array without first verifying that the array is non-empty. Supplying an empty pipeline causes a null pointer dereference and crashes the server.This issue affects MongoDB Server 8.2 versionsprior to 8.2.7.

CVSS Score has been rated as 7.1

Ops Manager RCE via webhook body (CVE-2026-8431)

Tue, 12 May 2026 18:37:47 GMT

An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax.This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.

CVSS Score has been rated as 9.4

Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields (CVE-2026-8201)

Wed, 13 May 2026 00:12:35 GMT

A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.This issue impacts MongoDB Servers mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

CVSS Score has been rated as 6.1

FlatBSON Duplicate Field Index Drift (CVE-2026-8053)

Tue, 12 May 2026 23:59:43 GMT

An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution.This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

CVSS Score has been rated as 8.7

Post-auth memory exhaustion via bitwise match expressions (CVE-2026-8199)

Wed, 13 May 2026 00:05:22 GMT

An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM.This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

CVSS Score has been rated as 7.1

Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands (CVE-2026-8336)

Wed, 13 May 2026 00:16:16 GMT

After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce commands map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service.This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

CVSS Score has been rated as 7.7

Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators (CVE-2026-8202)

Wed, 13 May 2026 00:19:41 GMT

Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time.This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

CVSS Score has been rated as 5.3

Client side encryption fails to encrypt values in a $vectorSearch (CVE-2026-9741)

Tue, 09 Jun 2026 21:56:01 GMT

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.

CVSS Score has been rated as 7.1

Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure (CVE-2026-18693)

Tue, 11 Aug 2026 18:38:31 GMT

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.

CVSS Score has been rated as 7.2

Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution (CVE-2026-18692)

Tue, 11 Aug 2026 18:36:54 GMT

An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.

CVSS Score has been rated as 7.7

Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure (CVE-2026-18691)

Tue, 11 Aug 2026 18:46:02 GMT

An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deployment.

CVSS Score has been rated as 9

Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections (CVE-2026-18690)

Tue, 11 Aug 2026 18:47:05 GMT

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.

CVSS Score has been rated as 7.2

Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure (CVE-2026-18688)

Tue, 11 Aug 2026 18:36:21 GMT

An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents.

CVSS Score has been rated as 7.1

Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption (CVE-2026-18687)

Tue, 11 Aug 2026 18:35:14 GMT

MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data.

CVSS Score has been rated as 7.1

Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader (CVE-2026-13078)

Wed, 22 Jul 2026 19:11:20 GMT

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

CVSS Score has been rated as 6.3

Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data (CVE-2026-13077)

Wed, 22 Jul 2026 19:12:11 GMT

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.

CVSS Score has been rated as 7.1

Aggregation Framework Memory Exhaustion Leading to Process Termination (CVE-2026-13076)

Wed, 22 Jul 2026 19:12:42 GMT

An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and requires both write access to the database and the ability to run aggregation queries.

CVSS Score has been rated as 7.1

$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation (CVE-2026-13075)

Wed, 22 Jul 2026 19:13:04 GMT

An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.

CVSS Score has been rated as 7.1

Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service (CVE-2026-13074)

Wed, 22 Jul 2026 19:13:33 GMT

An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability.

CVSS Score has been rated as 6.9

MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination (CVE-2026-13073)

Wed, 22 Jul 2026 19:13:55 GMT

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency triggered by a specific combination of aggregation options.

CVSS Score has been rated as 5.3

MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption (CVE-2026-13072)

Wed, 22 Jul 2026 19:14:15 GMT

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

CVSS Score has been rated as 9.2

Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination (CVE-2026-13071)

Wed, 22 Jul 2026 19:14:51 GMT

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.

CVSS Score has been rated as 7.1

Server crash via aggregation pipeline expression with compound wildcard index specification (CVE-2026-13055)

Wed, 22 Jul 2026 19:22:54 GMT

The $_internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

CVSS Score has been rated as 7.1

Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion (CVE-2026-13069)

Wed, 22 Jul 2026 19:15:38 GMT

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.

CVSS Score has been rated as 7.1

MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse (CVE-2026-13068)

Wed, 22 Jul 2026 19:16:13 GMT

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace.

CVSS Score has been rated as 2.3

tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket (CVE-2026-13067)

Wed, 22 Jul 2026 19:16:38 GMT

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.

CVSS Score has been rated as 7.2

Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure (CVE-2026-13066)

Wed, 22 Jul 2026 19:17:08 GMT

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.

CVSS Score has been rated as 7.1

MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination (CVE-2026-13065)

Wed, 22 Jul 2026 19:17:29 GMT

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.

CVSS Score has been rated as 7.1

MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service (CVE-2026-13064)

Wed, 22 Jul 2026 19:17:54 GMT

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.

CVSS Score has been rated as 7.1

libmongocrypt Improper Input Validation Leading to Process Termination (CVE-2026-13063)

Wed, 22 Jul 2026 19:18:26 GMT

An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively large memory allocation.

CVSS Score has been rated as 5.3

MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters (CVE-2026-13062)

Wed, 22 Jul 2026 19:19:01 GMT

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.

CVSS Score has been rated as 7.1

Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage (CVE-2026-13061)

Wed, 22 Jul 2026 19:19:34 GMT

An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.

CVSS Score has been rated as 5.3

$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access (CVE-2026-13060)

Wed, 22 Jul 2026 19:19:58 GMT

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

CVSS Score has been rated as 7.1

Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass (CVE-2026-13059)

Wed, 22 Jul 2026 19:21:06 GMT

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.

CVSS Score has been rated as 8.6

Transaction Command Insufficient Input Validation Leading to Process Termination (CVE-2026-13058)

Wed, 22 Jul 2026 19:21:34 GMT

An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.

CVSS Score has been rated as 7.1

Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META (CVE-2026-13057)

Wed, 22 Jul 2026 19:22:05 GMT

An issue in the servers Atlas Search integration allows an authenticated user to bypass per-user access controls.In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due to insufficient input validation, an authenticated client can supply these fields directly.

CVSS Score has been rated as 6

A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM (CVE-2026-13056)

Wed, 22 Jul 2026 19:22:27 GMT

Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.

CVSS Score has been rated as 7.1