CVEs.

Matching CVEs

1. 7.7High

   CVE-2026-89099 ↗ (opens in a new tab)

   A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of process memory with user-influenced content. Successful use of this issue may impact the confidentiality, integrity, and availability of the affected server process.

   MAMongoDB Atlas· Sep 11, 2026

2. 8.2High

   CVE-2026-88032 ↗ (opens in a new tab)

   A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.

   MAMongoDB Atlas· Sep 10, 2026

3. 7.1High

   CVE-2026-88028 ↗ (opens in a new tab)

   Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence a stored relation identifier may cause an affected application to return a document other than the intended relation target.

   MAMongoDB Atlas· Sep 10, 2026

4. 7.1High

   CVE-2026-88027 ↗ (opens in a new tab)

   Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwrite an embedded document other than the intended target.

   MAMongoDB Atlas· Sep 10, 2026

5. 7.1High

   CVE-2026-88026 ↗ (opens in a new tab)

   Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter.

   MAMongoDB Atlas· Sep 10, 2026

6. 8.4High

   CVE-2026-88022 ↗ (opens in a new tab)

   Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument `where` method when the operator is `=` or `eq`, as well as the `find` and `delete` methods that use that code path. An attacker who can cause an affected application to supply an operator-shaped array to one of these APIs may obtain a document other than the intended target or delete documents beyond the intended target.

   MAMongoDB Atlas· Sep 10, 2026

7. 7.1High

   CVE-2026-82076 ↗ (opens in a new tab)

   An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of service affecting all databases served by the affected node.

   MAMongoDB Atlas· Sep 8, 2026

8. 8.7High

   CVE-2026-82075 ↗ (opens in a new tab)

   An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication, elevated privileges, or user interaction is required. Only availability is affected; data confidentiality and integrity are not impacted.

   MAMongoDB Atlas· Sep 8, 2026

9. 7.1High

   CVE-2026-82074 ↗ (opens in a new tab)

   MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.

   MAMongoDB Atlas· Sep 8, 2026

10. 7.1High

    CVE-2026-82073 ↗ (opens in a new tab)

    A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an internal command parameter that can be set by external clients, causing a security check to be improperly skipped.

    MAMongoDB Atlas· Sep 8, 2026

11. 7.2High

    CVE-2026-82071 ↗ (opens in a new tab)

    Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.

    MAMongoDB Atlas· Sep 8, 2026

12. 7.1High

    CVE-2026-82070 ↗ (opens in a new tab)

    A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session with monitoring-level permissions and results in exposure of cleartext credentials that could enable impersonation of other users, including privileged accounts.

    MAMongoDB Atlas· Sep 8, 2026

13. 7.1High

    CVE-2026-82068 ↗ (opens in a new tab)

    A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster. Manual intervention is required to restore service availability.

    MAMongoDB Atlas· Sep 8, 2026

14. 7.1High

    CVE-2026-82065 ↗ (opens in a new tab)

    A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the metadata is subsequently read by diagnostic operations. The corrupted metadata persists across server restarts and is replicated to other cluster members, requiring manual operator intervention to restore service.

    MAMongoDB Atlas· Sep 8, 2026

15. 8.7High

    CVE-2026-82064 ↗ (opens in a new tab)

    A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about internal state do not hold for all member configurations, causing the server process to terminate.

    MAMongoDB Atlas· Sep 8, 2026

16. 7.0High

    CVE-2026-82062 ↗ (opens in a new tab)

    A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writes to arbitrary internal storage tables. The authorization check for these operations validates only the operation's namespace, not the actual storage target, enabling writes to unrelated internal met

    MAMongoDB Atlas· Sep 8, 2026

17. 7.2High

    CVE-2026-82061 ↗ (opens in a new tab)

    A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required.

    MAMongoDB Atlas· Sep 8, 2026

18. 7.1High

    CVE-2026-82058 ↗ (opens in a new tab)

    A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path performs unsafe numeric conversion on the user-controlled field name without proper exception handling, resulting in an uncaught exception that terminates the server process. This is possible because incoming wire protocol BSON validation does not enforce that array element field names are valid, in-range

    MAMongoDB Atlas· Sep 8, 2026

19. 7.1High

    CVE-2026-82057 ↗ (opens in a new tab)

    A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently read from the misconfigured collection, the resulting mismatch in expected data format led to corrupted memory interpretation and a server crash. The crafted collection configuration persists across restarts, requiring manual operator intervention

    MAMongoDB Atlas· Sep 8, 2026

20. 7.1High

    CVE-2026-82055 ↗ (opens in a new tab)

    A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an internal object in an invalid, partially initialized state. During subsequent index key generation, access to this improperly initialized object results in a null pointer dereference that terminates the mongod process. An authenticated user with write access can use this to cause a denial of service.

    MAMongoDB Atlas· Sep 8, 2026

21. 7.1High

    CVE-2026-82054 ↗ (opens in a new tab)

    A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.

    MAMongoDB Atlas· Sep 8, 2026

22. 7.6High

    CVE-2026-82053 ↗ (opens in a new tab)

    A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control configuration, potentially allowing an authenticated user to acquire elevated privileges that were not intended by the deployment's authorization policy.

    MAMongoDB Atlas· Sep 8, 2026

23. 7.1High

    CVE-2026-82052 ↗ (opens in a new tab)

    The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.

    MAMongoDB Atlas· Sep 8, 2026

24. 8.2High

    CVE-2026-84964 ↗ (opens in a new tab)

    A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly.

    MAMongoDB Atlas· Sep 3, 2026

25. 7.1High

    CVE-2026-84971 ↗ (opens in a new tab)

    Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running.

    MAMongoDB Atlas· Sep 3, 2026

26. 8.7High

    CVE-2026-81532 ↗ (opens in a new tab)

    A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message, memory adjacent to that buffer is overwritten with user-supplied content. This can terminate the hosting application process and may allow unintended code to run within it.

    MAMongoDB Atlas· Aug 28, 2026

27. 8.7High

    CVE-2026-81520 ↗ (opens in a new tab)

    A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions.

    MAMongoDB Atlas· Aug 28, 2026

28. 8.7High

    CVE-2026-81518 ↗ (opens in a new tab)

    When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.

    MAMongoDB Atlas· Aug 28, 2026

29. 8.7High

    CVE-2026-81517 ↗ (opens in a new tab)

    An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operation subsequently fails, the resulting error is not handled and the shared mongosqld process ends, ending service for all connected SQL clients. The process continues to end on startup until an operator restores available storage, and the diagnostic message explaining the condition is not recorded.

    MAMongoDB Atlas· Aug 28, 2026

30. 8.3High

    CVE-2026-81490 ↗ (opens in a new tab)

    A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message as transient and, after the configured retries are exhausted, proceeds without a valid result, ending the schema refresh routine. The mongosqld process continues running without a usable schema, so SQL clients are unable to obtain results until an operator removes the view or excludes its namespace from sampling.

    MAMongoDB Atlas· Aug 28, 2026

31. 8.5High

    CVE-2026-77586 ↗ (opens in a new tab)

    In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write to a sampled MongoDB collection can choose a name that closes the quoted identifier early, so that additional SQL text becomes part of the generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.

    MAMongoDB Atlas· Aug 28, 2026

32. 7.1High

    CVE-2026-81529 ↗ (opens in a new tab)

    Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.

    MAMongoDB Atlas· Aug 27, 2026

33. 7.1High

    CVE-2026-81526 ↗ (opens in a new tab)

    The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application's own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application.

    MAMongoDB Atlas· Aug 27, 2026

34. 8.6High

    CVE-2026-81525 ↗ (opens in a new tab)

    The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

    MAMongoDB Atlas· Aug 27, 2026

35. 8.6High

    CVE-2026-81522 ↗ (opens in a new tab)

    A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

    MAMongoDB Atlas· Aug 27, 2026

36. 7.1High

    CVE-2026-81521 ↗ (opens in a new tab)

    The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

    MAMongoDB Atlas· Aug 27, 2026

37. 8.2High

    CVE-2026-75159 ↗ (opens in a new tab)

    An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until the process restarts.

    MAMongoDB Atlas· Aug 27, 2026

38. 8.4High

    CVE-2026-19003 ↗ (opens in a new tab)

    A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running th

    MAMongoDB Atlas· Aug 12, 2026

39. 8.8High

    CVE-2026-19004 ↗ (opens in a new tab)

    An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.

    MAMongoDB Atlas· Aug 12, 2026

40. 8.8High

    CVE-2026-19002 ↗ (opens in a new tab)

    A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.

    MAMongoDB Atlas· Aug 12, 2026

41. 7.1High

    CVE-2026-18888 ↗ (opens in a new tab)

    The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.

    MAMongoDB Atlas· Aug 12, 2026

42. 8.2High

    CVE-2026-18710 ↗ (opens in a new tab)

    A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.

    MAMongoDB Atlas· Aug 11, 2026

43. 7.2High

    CVE-2026-18712 ↗ (opens in a new tab)

    An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.

    MAMongoDB Atlas· Aug 11, 2026

44. 7.1High

    CVE-2026-18711 ↗ (opens in a new tab)

    An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query results.

    MAMongoDB Atlas· Aug 11, 2026

45. 7.5High

    CVE-2026-18706 ↗ (opens in a new tab)

    An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.

    MAMongoDB Atlas· Aug 11, 2026

46. 7.1High

    CVE-2026-18705 ↗ (opens in a new tab)

    An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.

    MAMongoDB Atlas· Aug 11, 2026

47. 7.1High

    CVE-2026-18704 ↗ (opens in a new tab)

    An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.

    MAMongoDB Atlas· Aug 11, 2026

48. 7.1High

    CVE-2026-18701 ↗ (opens in a new tab)

    An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.

    MAMongoDB Atlas· Aug 11, 2026

49. 8.7High

    CVE-2026-18697 ↗ (opens in a new tab)

    An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.

    MAMongoDB Atlas· Aug 11, 2026

50. 7.0High

    CVE-2026-18696 ↗ (opens in a new tab)

    An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual operation.

    MAMongoDB Atlas· Aug 11, 2026