CVEs.

Matching CVEs

1. 6.3Med

   CVE-2026-114651 ↗ (opens in a new tab)

   A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps certain primitive collection types can cause residual bytes from unrelated data processed earlier on the same execution thread to be surfaced as legitimate values. This can result in disclosure of a limited amount of information belonging to other requests or principals of the consuming application.

   MAMongoDB Atlas· Oct 22, 2026

2. 6.9Med

   CVE-2026-114650 ↗ (opens in a new tab)

   A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer fails to associate the operation with its configured encryption rules and the operation proceeds without an error being raised. An application user with the ability to write data through an affected application can therefore have sensitive fields persisted in plaintext, defeating the confidentiality g

   MAMongoDB Atlas· Oct 22, 2026

3. 7.6High

   CVE-2026-114649 ↗ (opens in a new tab)

   The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.

   MAMongoDB Atlas· Oct 22, 2026

4. 7.2High

   CVE-2026-114648 ↗ (opens in a new tab)

   The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.

   MAMongoDB Atlas· Oct 22, 2026

5. 5.3Med

   CVE-2026-114647 ↗ (opens in a new tab)

   The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.

   MAMongoDB Atlas· Oct 22, 2026

6. 6.9Med

   CVE-2026-114646 ↗ (opens in a new tab)

   A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the amount of data actually provided, and it copies the data onto the wire unchanged. An unauthenticated party who can supply binary content to such an application can thereby cause additional elements to be inserted into, or existing elements to be removed from, the database command the application issu

   MAMongoDB Atlas· Oct 22, 2026

7. 5.7Med

   CVE-2026-114645 ↗ (opens in a new tab)

   A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side configuration, in conjunction with the affected authentication mechanism, can cause the driver to write outside the bounds of the allocated buffer. This may result in corruption of client process memory and denial of service of the client application. The issue affects only client builds compiled with the Win

   MAMongoDB Atlas· Oct 22, 2026

8. 8.2High

   CVE-2026-114644 ↗ (opens in a new tab)

   The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is a

   MAMongoDB Atlas· Oct 22, 2026

9. 5.3Med

   CVE-2026-114643 ↗ (opens in a new tab)

   The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the server and the driver resolve different values for the same record. Affected records can also become unreadable through the driver, interrupting application code that reads them.

   MAMongoDB Atlas· Oct 22, 2026

10. 8.6High

    CVE-2026-113870 ↗ (opens in a new tab)

    MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.

    MAMongoDB Atlas· Oct 21, 2026

11. 8.2High

    CVE-2026-112368 ↗ (opens in a new tab)

    An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.

    MAMongoDB Atlas· Oct 19, 2026

12. 7.1High

    CVE-2026-96299 ↗ (opens in a new tab)

    A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all client

    MAMongoDB Atlas· Oct 13, 2026

13. 6.0Med

    CVE-2026-96297 ↗ (opens in a new tab)

    Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelated data from the server process. Depending on the state of memory at the time, the server process may also terminate unexpectedly. The behavior can occur when an authenticated user with read privileges

    MAMongoDB Atlas· Oct 13, 2026

14. 7.1High

    CVE-2026-104005 ↗ (opens in a new tab)

    A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all client

    MAMongoDB Atlas· Oct 13, 2026

15. 7.1High

    CVE-2026-104004 ↗ (opens in a new tab)

    MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.

    MAMongoDB Atlas· Oct 13, 2026

16. 5.3Med

    CVE-2026-103965 ↗ (opens in a new tab)

    An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

    MAMongoDB Atlas· Oct 13, 2026

17. 6.9Med

    CVE-2026-87110 ↗ (opens in a new tab)

    An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue.

    MAMongoDB Atlas· Oct 9, 2026

18. 6.0Med

    CVE-2026-87109 ↗ (opens in a new tab)

    An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.

    MAMongoDB Atlas· Oct 9, 2026

19. 2.3Low

    CVE-2026-87108 ↗ (opens in a new tab)

    An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.

    MAMongoDB Atlas· Oct 9, 2026

20. 5.9Med

    CVE-2026-106435 ↗ (opens in a new tab)

    The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.

    MAMongoDB Atlas· Oct 8, 2026

21. 6.3Med

    CVE-2026-106436 ↗ (opens in a new tab)

    The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.

    MAMongoDB Atlas· Oct 8, 2026

22. 2.0Low

    CVE-2026-106432 ↗ (opens in a new tab)

    The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.

    MAMongoDB Atlas· Oct 8, 2026

23. 8.2High

    CVE-2026-107325 ↗ (opens in a new tab)

    Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.

    MAMongoDB Atlas· Oct 8, 2026

24. 8.2High

    CVE-2026-107324 ↗ (opens in a new tab)

    An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.

    MAMongoDB Atlas· Oct 8, 2026

25. 5.1Med

    CVE-2026-106438 ↗ (opens in a new tab)

    An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.

    MAMongoDB Atlas· Oct 8, 2026

26. 5.9Med

    CVE-2026-106437 ↗ (opens in a new tab)

    The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.

    MAMongoDB Atlas· Oct 8, 2026

27. 5.3Med

    CVE-2026-106434 ↗ (opens in a new tab)

    The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.

    MAMongoDB Atlas· Oct 8, 2026

28. 8.7High

    CVE-2026-106433 ↗ (opens in a new tab)

    Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.

    MAMongoDB Atlas· Oct 8, 2026

29. 5.9Med

    CVE-2026-106431 ↗ (opens in a new tab)

    An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process. Reaching this issue requires the application to use the BSON bulk-writer API and produce a precise cumulative document size.

    MAMongoDB Atlas· Oct 8, 2026

30. 6.0Med

    CVE-2026-106430 ↗ (opens in a new tab)

    The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an affected application can cause the application to read distinct values from an unintended field or rename an unintended collection. These operations use the application's existing database credentials.

    MAMongoDB Atlas· Oct 8, 2026

31. 7.1High

    CVE-2026-106429 ↗ (opens in a new tab)

    An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds.

    MAMongoDB Atlas· Oct 8, 2026

32. 6.3Med

    CVE-2026-106428 ↗ (opens in a new tab)

    An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.

    MAMongoDB Atlas· Oct 8, 2026

33. 2.3Low

    CVE-2026-103546 ↗ (opens in a new tab)

    In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation.

    MAMongoDB Atlas· Oct 5, 2026

34. 7.5High

    CVE-2026-96749 ↗ (opens in a new tab)

    An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer ins

    MAMongoDB Atlas· Sep 24, 2026

35. 8.3High

    CVE-2026-96748 ↗ (opens in a new tab)

    PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

    MAMongoDB Atlas· Sep 24, 2026

36. 5.3Med

    CVE-2026-96747 ↗ (opens in a new tab)

    The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.

    MAMongoDB Atlas· Sep 24, 2026

37. 7.3High

    CVE-2026-96750 ↗ (opens in a new tab)

    MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.

    MAMongoDB Atlas· Sep 24, 2026

38. 8.3High

    CVE-2026-96746 ↗ (opens in a new tab)

    An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly.

    MAMongoDB Atlas· Sep 24, 2026

39. 6.3Med

    CVE-2026-96745 ↗ (opens in a new tab)

    Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the applica

    MAMongoDB Atlas· Sep 24, 2026

40. 7.1High

    CVE-2026-96744 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations.

    MAMongoDB Atlas· Sep 24, 2026

41. 7.1High

    CVE-2026-93764 ↗ (opens in a new tab)

    Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.

    MAMongoDB Atlas· Sep 18, 2026

42. 7.1High

    CVE-2026-93763 ↗ (opens in a new tab)

    A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the database can then read values that were intended to be protected from that party. This may result in unintended disclosure of sensitive information.

    MAMongoDB Atlas· Sep 18, 2026

43. 9.2Crit

    CVE-2026-93762 ↗ (opens in a new tab)

    Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.

    MAMongoDB Atlas· Sep 18, 2026

44. 8.7High

    CVE-2026-93761 ↗ (opens in a new tab)

    An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive.

    MAMongoDB Atlas· Sep 18, 2026

45. 8.3High

    CVE-2026-93760 ↗ (opens in a new tab)

    Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.

    MAMongoDB Atlas· Sep 18, 2026

46. 8.8High

    CVE-2026-93759 ↗ (opens in a new tab)

    Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.

    MAMongoDB Atlas· Sep 18, 2026

47. 8.3High

    CVE-2026-93765 ↗ (opens in a new tab)

    Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field update. This may result in unintended removal of stored records and in the embedding application becoming unresponsive.

    MAMongoDB Atlas· Sep 18, 2026

48. 8.6High

    CVE-2026-93758 ↗ (opens in a new tab)

    An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.

    MAMongoDB Atlas· Sep 18, 2026

49. 6.9Med

    CVE-2026-93395 ↗ (opens in a new tab)

    A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an a

    MAMongoDB Atlas· Sep 17, 2026

50. 6.3Med

    CVE-2026-93394 ↗ (opens in a new tab)

    A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.

    MAMongoDB Atlas· Sep 17, 2026