CVEs.

Matching CVEs

1. 8.7High

   CVE-2026-120828 ↗ (opens in a new tab)

   A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that names a point in time the node will never reach. A party with network access and no credentials can cause these records to accumulate without bound and persist after the requests end, which may make the server run out of memory and become unavailable.

   MAMongoDB Atlas· Nov 10, 2026

2. 7.1High

   CVE-2026-120826 ↗ (opens in a new tab)

   An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checking. Reading that view may result in unintended access to data belonging to other databases held on the same shard.

   MAMongoDB Atlas· Nov 10, 2026

3. 7.1High

   CVE-2026-120825 ↗ (opens in a new tab)

   An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material.

   MAMongoDB Atlas· Nov 10, 2026

4. 8.7High

   CVE-2026-120824 ↗ (opens in a new tab)

   A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directly, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process.

   MAMongoDB Atlas· Nov 10, 2026

5. 8.6High

   CVE-2026-120822 ↗ (opens in a new tab)

   MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read and relocate collections outside the set that user is permitted to access. This may result in unintended access to data and unintended changes to the collection catalog.

   MAMongoDB Atlas· Nov 10, 2026

6. 7.1High

   CVE-2026-120821 ↗ (opens in a new tab)

   A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipeline. The condition can be caused by an authenticated user with read privileges, and may result in the server terminating unexpectedly.

   MAMongoDB Atlas· Nov 10, 2026

7. 7.1High

   CVE-2026-120818 ↗ (opens in a new tab)

   A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed process memory to be read and returned. An authenticated user with minimal or no assigned roles can trigger this condition over the normal network protocol by submitting a single crafted aggregation request, with no additional privileges or non-default configuration. Successful triggering this issue may result in adjacent process memory contents being returned, including data that undermines memory-layout randomization, and may in some cases affect server

   MAMongoDB Atlas· Nov 10, 2026

8. 7.1High

   CVE-2026-120817 ↗ (opens in a new tab)

   A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection validator that uses geospatial query operators. The condition can be caused by an authenticated user with write privileges, and may result in the server terminating unexpectedly.

   MAMongoDB Atlas· Nov 10, 2026

9. 8.6High

   CVE-2026-120815 ↗ (opens in a new tab)

   An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended access to stored data and credentials, unintended modification of data, and loss of availability of the server.

   MAMongoDB Atlas· Nov 10, 2026

10. 7.5High

    CVE-2026-120814 ↗ (opens in a new tab)

    An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrative privileges to cause persisted internal coordination state to be reprocessed with elevated internal authority. Because that state is trusted rather than re-validated, operations may be carried out beyond the user's authorized scope, including changes to cluster-wide security configuration. Successful triggering this issue requires an authenticated session directly against a cluster member and can result in unauthorized access to and modification of data

    MAMongoDB Atlas· Nov 10, 2026

11. 8.2High

    CVE-2026-120813 ↗ (opens in a new tab)

    An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be silently dropped during schema parsing under certain conditions. A party who can deliver a specially crafted schema to a user's CSFLE client may cause sensitive data intended for encryption to be stored in plaintext, bypassing confidentiality protections. Exploitation requires the ability to deliver the malicious schema to the user's client, such as through a man-in-the-middle position or an untrusted server.

    MAMongoDB Atlas· Nov 10, 2026

12. 7.1High

    CVE-2026-120810 ↗ (opens in a new tab)

    An issue in MongoDB server’s aggregation framework allows an authenticated user with read privileges to cause a denial of service by sending specially crafted aggregate commands using an internal expression. Despite its internal naming, this expression is registered as accessible to any authenticated client. By supplying crafted input parameters across multiple concurrent connections, each evaluation triggers unbounded memory allocations with no per-expression memory limits enforced. This can exhaust available server memory and cause the mongod process to be terminated by the operating system’

    MAMongoDB Atlas· Nov 10, 2026

13. 7.5High

    CVE-2026-120807 ↗ (opens in a new tab)

    A flaw in MongoDB’s X.509 cluster-membership authentication guard could allow a holder of a cluster-member certificate to gain elevated internal privileges when a specific deployment configuration is in use. An internal check, which prevents a certificate recognized as a cluster member from also being treated as a regular user, does not correctly distinguish between certain error conditions encountered during user lookup. Under certain timing conditions, this can cause the check to be bypassed, granting the connection full internal system privileges. Triggering this issue requires possession o

    MAMongoDB Atlas· Nov 10, 2026

14. 7.0High

    CVE-2026-120806 ↗ (opens in a new tab)

    A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a database. Due to incorrect internal query predicates, the drop operation removes role definitions but fails to remove stale references in user and role documents. If a role with the same name is subsequently recreated with different privileges, previously associated users may silently inherit the new role's privileges without an explicit grant or corresponding audit event. Exploitation requires authenticated access with database administrative privileges o

    MAMongoDB Atlas· Nov 10, 2026

15. 8.2High

    CVE-2026-120804 ↗ (opens in a new tab)

    A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authentication requests, the server fails to properly release an underlying system resource due to an internal tracking error. An unauthenticated user can trigger this by repeatedly sending authentication requests using the Kerberos mechanism, eventually exhausting available resources and causing all subsequent Kerberos authentication attempts to fail. Server restart is required to recover.

    MAMongoDB Atlas· Nov 10, 2026

16. 7.1High

    CVE-2026-120803 ↗ (opens in a new tab)

    A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator used by certain $setWindowFields aggregation pipelines. Under specific conditions, the accumulator can retain a dangling pointer to memory that has since been freed. When this stale pointer is later dereferenced during serialization of the carried-forward value, it can result in a heap out-of-bounds read that may expose adjacent heap contents and crash the mongod server. An authenticated user with readWrite privileges on a database can trigger this issue by crafting a specific

    MAMongoDB Atlas· Nov 10, 2026

17. 7.1High

    CVE-2026-120956 ↗ (opens in a new tab)

    The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.

    MAMongoDB Atlas· Nov 3, 2026

18. 8.7High

    CVE-2026-120955 ↗ (opens in a new tab)

    The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.

    MAMongoDB Atlas· Nov 3, 2026

19. 8.7High

    CVE-2026-120678 ↗ (opens in a new tab)

    A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.

    MAMongoDB Atlas· Nov 3, 2026

20. 8.3High

    CVE-2026-119179 ↗ (opens in a new tab)

    A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.

    MAMongoDB Atlas· Nov 3, 2026

21. 7.6High

    CVE-2026-116641 ↗ (opens in a new tab)

    The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check. The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0

    MAMongoDB Atlas· Oct 28, 2026

22. 7.7High

    CVE-2026-118510 ↗ (opens in a new tab)

    A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.

    MAMongoDB Atlas· Oct 28, 2026

23. 7.6High

    CVE-2026-115930 ↗ (opens in a new tab)

    The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.

    MAMongoDB Atlas· Oct 26, 2026

24. 7.6High

    CVE-2026-115929 ↗ (opens in a new tab)

    MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.

    MAMongoDB Atlas· Oct 24, 2026

25. 7.1High

    CVE-2026-114653 ↗ (opens in a new tab)

    A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the store

    MAMongoDB Atlas· Oct 22, 2026

26. 7.1High

    CVE-2026-114652 ↗ (opens in a new tab)

    A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the application passes into the affected builder surface, without any special privilege beyond ordinary read-write application access, may cause stored data to be modified or removed in ways the application never intended. The result is unauthorized integrity impact on the affected application data; there is no

    MAMongoDB Atlas· Oct 22, 2026

27. 7.6High

    CVE-2026-114649 ↗ (opens in a new tab)

    The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.

    MAMongoDB Atlas· Oct 22, 2026

28. 7.2High

    CVE-2026-114648 ↗ (opens in a new tab)

    The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.

    MAMongoDB Atlas· Oct 22, 2026

29. 8.2High

    CVE-2026-114644 ↗ (opens in a new tab)

    The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is a

    MAMongoDB Atlas· Oct 22, 2026

30. 8.6High

    CVE-2026-113870 ↗ (opens in a new tab)

    MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.

    MAMongoDB Atlas· Oct 21, 2026

31. 8.2High

    CVE-2026-112368 ↗ (opens in a new tab)

    An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.

    MAMongoDB Atlas· Oct 19, 2026

32. 7.1High

    CVE-2026-96299 ↗ (opens in a new tab)

    A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all client

    MAMongoDB Atlas· Oct 13, 2026

33. 7.1High

    CVE-2026-104005 ↗ (opens in a new tab)

    A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all client

    MAMongoDB Atlas· Oct 13, 2026

34. 7.1High

    CVE-2026-104004 ↗ (opens in a new tab)

    MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.

    MAMongoDB Atlas· Oct 13, 2026

35. 8.2High

    CVE-2026-107325 ↗ (opens in a new tab)

    Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

    MAMongoDB Atlas· Oct 8, 2026

36. 8.2High

    CVE-2026-107324 ↗ (opens in a new tab)

    An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.

    MAMongoDB Atlas· Oct 8, 2026

37. 8.7High

    CVE-2026-106433 ↗ (opens in a new tab)

    Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.

    MAMongoDB Atlas· Oct 8, 2026

38. 7.1High

    CVE-2026-106429 ↗ (opens in a new tab)

    An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds.

    MAMongoDB Atlas· Oct 8, 2026

39. 7.5High

    CVE-2026-96749 ↗ (opens in a new tab)

    An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer ins

    MAMongoDB Atlas· Sep 24, 2026

40. 8.3High

    CVE-2026-96748 ↗ (opens in a new tab)

    PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

    MAMongoDB Atlas· Sep 24, 2026

41. 7.3High

    CVE-2026-96750 ↗ (opens in a new tab)

    MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.

    MAMongoDB Atlas· Sep 24, 2026

42. 8.3High

    CVE-2026-96746 ↗ (opens in a new tab)

    An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly.

    MAMongoDB Atlas· Sep 24, 2026

43. 7.1High

    CVE-2026-96744 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations.

    MAMongoDB Atlas· Sep 24, 2026

44. 7.1High

    CVE-2026-93764 ↗ (opens in a new tab)

    Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.

    MAMongoDB Atlas· Sep 18, 2026

45. 7.1High

    CVE-2026-93763 ↗ (opens in a new tab)

    A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the database can then read values that were intended to be protected from that party. This may result in unintended disclosure of sensitive information.

    MAMongoDB Atlas· Sep 18, 2026

46. 8.7High

    CVE-2026-93761 ↗ (opens in a new tab)

    An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.

    MAMongoDB Atlas· Sep 18, 2026

47. 8.3High

    CVE-2026-93760 ↗ (opens in a new tab)

    Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.

    MAMongoDB Atlas· Sep 18, 2026

48. 8.8High

    CVE-2026-93759 ↗ (opens in a new tab)

    Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.

    MAMongoDB Atlas· Sep 18, 2026

49. 8.3High

    CVE-2026-93765 ↗ (opens in a new tab)

    Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field update. This may result in unintended removal of stored records and in the embedding application becoming unresponsive.

    MAMongoDB Atlas· Sep 18, 2026

50. 8.6High

    CVE-2026-93758 ↗ (opens in a new tab)

    An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.

    MAMongoDB Atlas· Sep 18, 2026