CVEs.

Matching CVEs

1. 5.1Med

   CVE-2026-82069 ↗ (opens in a new tab)

   A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface.

   MAMongoDB Atlas· Sep 8, 2026

2. 5.3Med

   CVE-2026-82066 ↗ (opens in a new tab)

   A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable through diagnostic query statistics output.

   MAMongoDB Atlas· Sep 8, 2026

3. 6.0Med

   CVE-2026-82063 ↗ (opens in a new tab)

   A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently dereferenced during cursor cleanup, leading to a server process crash.

   MAMongoDB Atlas· Sep 8, 2026

4. 6.0Med

   CVE-2026-82059 ↗ (opens in a new tab)

   An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key generation code path. In certain build configurations, this assertion failure results in termination of the mongod process, causing a denial of service to all connected clients.

   MAMongoDB Atlas· Sep 8, 2026

5. 6.0Med

   CVE-2026-82056 ↗ (opens in a new tab)

   A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed, leading to a server crash. An authenticated user with readWrite privileges can trigger this condition through specific concurrent text-search and index management operations, resulting in denial of service for all connected clients. This

   MAMongoDB Atlas· Sep 8, 2026

6. 6.9Med

   CVE-2026-84968 ↗ (opens in a new tab)

   An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.

   MAMongoDB Atlas· Sep 3, 2026

7. 5.1Med

   CVE-2026-84967 ↗ (opens in a new tab)

   A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not displ

   MAMongoDB Atlas· Sep 3, 2026

8. 5.9Med

   CVE-2026-84966 ↗ (opens in a new tab)

   An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.

   MAMongoDB Atlas· Sep 3, 2026

9. 5.9Med

   CVE-2026-84965 ↗ (opens in a new tab)

   An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.

   MAMongoDB Atlas· Sep 3, 2026

10. 6.3Med

    CVE-2026-84963 ↗ (opens in a new tab)

    An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.

    MAMongoDB Atlas· Sep 3, 2026

11. 5.7Med

    CVE-2026-84962 ↗ (opens in a new tab)

    An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

    MAMongoDB Atlas· Sep 3, 2026

12. 5.9Med

    CVE-2026-84970 ↗ (opens in a new tab)

    A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.

    MAMongoDB Atlas· Sep 3, 2026

13. 6.3Med

    CVE-2026-84969 ↗ (opens in a new tab)

    A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.

    MAMongoDB Atlas· Sep 3, 2026

14. 6.0Med

    CVE-2026-81533 ↗ (opens in a new tab)

    An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length. A user able to influence the numeric portion of a LIMIT clause could cause the hosting application process to terminate unexpectedly or corrupt adjacent memory in that process.

    MAMongoDB Atlas· Aug 28, 2026

15. 5.7Med

    CVE-2026-77184 ↗ (opens in a new tab)

    In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in deployments configured to build their SQL schema from those validators, can cause additional SQL text to be embedded in that generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.

    MAMongoDB Atlas· Aug 28, 2026

16. 6.9Med

    CVE-2026-76798 ↗ (opens in a new tab)

    The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query is interpreted by the browser when an operator later generates and opens the report, which may disclose other users' logged query text and user names to an external party or present misleading content to the operator. Generating a report over logs containing the affected entries and opening that repor

    MAMongoDB Atlas· Aug 28, 2026

17. 5.8Med

    CVE-2026-76797 ↗ (opens in a new tab)

    The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a formula when an operator opens the generated report in a spreadsheet application, which may result in unintended disclosure of report contents or execution of external content on the operator's workstation. Generating a report for the affected namespace and opening it in a spreadsheet application is re

    MAMongoDB Atlas· Aug 28, 2026

18. 4.8Med

    CVE-2026-76794 ↗ (opens in a new tab)

    MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report contents or altering its display.

    MAMongoDB Atlas· Aug 28, 2026

19. 6.8Med

    CVE-2026-81530 ↗ (opens in a new tab)

    A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked as other secret fields are. A party able to read the application's logs, diagnostic output, or a process memory dump may thereby recover the plaintext credentials and use them to decrypt protected field data.

    MAMongoDB Atlas· Aug 27, 2026

20. 5.3Med

    CVE-2026-81528 ↗ (opens in a new tab)

    A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.

    MAMongoDB Atlas· Aug 27, 2026

21. 6.9Med

    CVE-2026-81527 ↗ (opens in a new tab)

    A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended d

    MAMongoDB Atlas· Aug 27, 2026

22. 5.3Med

    CVE-2026-81524 ↗ (opens in a new tab)

    A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.

    MAMongoDB Atlas· Aug 27, 2026

23. 4.1Med

    CVE-2026-75573 ↗ (opens in a new tab)

    In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclosed password to access the associated TLS client key.

    MAMongoDB Atlas· Aug 27, 2026

24. 6.3Med

    CVE-2026-19503 ↗ (opens in a new tab)

    MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.

    MAMongoDB Atlas· Aug 12, 2026

25. 6.8Med

    CVE-2026-19502 ↗ (opens in a new tab)

    MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.

    MAMongoDB Atlas· Aug 12, 2026

26. 5.9Med

    CVE-2026-18709 ↗ (opens in a new tab)

    An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.

    MAMongoDB Atlas· Aug 11, 2026

27. 5.3Med

    CVE-2026-18708 ↗ (opens in a new tab)

    An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.

    MAMongoDB Atlas· Aug 11, 2026

28. 5.3Med

    CVE-2026-18707 ↗ (opens in a new tab)

    An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.

    MAMongoDB Atlas· Aug 11, 2026

29. 5.3Med

    CVE-2026-18702 ↗ (opens in a new tab)

    An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitoring by causing excessive log volume.

    MAMongoDB Atlas· Aug 11, 2026

30. 6.0Med

    CVE-2026-18700 ↗ (opens in a new tab)

    An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service.

    MAMongoDB Atlas· Aug 11, 2026

31. 6.0Med

    CVE-2026-18699 ↗ (opens in a new tab)

    An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connected clients and in-flight operations.

    MAMongoDB Atlas· Aug 11, 2026

32. 5.3Med

    CVE-2026-18698 ↗ (opens in a new tab)

    An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations, unauthorized modification of system collection data.

    MAMongoDB Atlas· Aug 11, 2026

33. 6.3Med

    CVE-2026-13078 ↗ (opens in a new tab)

    A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

    MAMongoDB Atlas· Jul 22, 2026

34. 6.9Med

    CVE-2026-13074 ↗ (opens in a new tab)

    An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability.

    MAMongoDB Atlas· Jul 22, 2026

35. 5.3Med

    CVE-2026-13073 ↗ (opens in a new tab)

    An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency triggered by a specific combination of aggregation options.

    MAMongoDB Atlas· Jul 22, 2026

36. 6.0Med

    CVE-2026-13070 ↗ (opens in a new tab)

    A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificate authority, or for the connection to traverse an untrusted network path.

    MAMongoDB Atlas· Jul 22, 2026

37. 5.3Med

    CVE-2026-13063 ↗ (opens in a new tab)

    An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively large memory allocation.

    MAMongoDB Atlas· Jul 22, 2026

38. 5.3Med

    CVE-2026-13061 ↗ (opens in a new tab)

    An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.

    MAMongoDB Atlas· Jul 22, 2026

39. 6.0Med

    CVE-2026-13057 ↗ (opens in a new tab)

    An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due to insufficient input validation, an authenticated client can supply these fields directly.

    MAMongoDB Atlas· Jul 22, 2026

40. 6.8Med

    CVE-2026-9751 ↗ (opens in a new tab)

    The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.

    MAMongoDB Atlas· Jun 9, 2026

41. 6.8Med

    CVE-2026-9735 ↗ (opens in a new tab)

    MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.

    MAMongoDB Atlas· Jun 9, 2026

42. 5.3Med

    CVE-2026-9101 ↗ (opens in a new tab)

    Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.

    MAMongoDB Atlas· May 20, 2026

43. 6.0Med

    CVE-2026-9100 ↗ (opens in a new tab)

    The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

    MAMongoDB Atlas· May 20, 2026

44. 6.0Med

    CVE-2026-6811 ↗ (opens in a new tab)

    Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.

    MAMongoDB Atlas· May 14, 2026

45. 5.3Med

    CVE-2026-8202 ↗ (opens in a new tab)

    Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

    MAMongoDB Atlas· May 13, 2026

46. 6.1Med

    CVE-2026-8201 ↗ (opens in a new tab)

    A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

    MAMongoDB Atlas· May 13, 2026

47. 4.8Med

    CVE-2026-8200 ↗ (opens in a new tab)

    When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

    MAMongoDB Atlas· May 13, 2026

48. 5.3Med

    CVE-2026-6915 ↗ (opens in a new tab)

    An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account.

    MAMongoDB Atlas· Apr 29, 2026

49. 5.3Med

    CVE-2026-6231 ↗ (opens in a new tab)

    The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data before further processing. This issue affects MongoDB C Driver versions prior to 1.30.5, MongoDB C Driver version 2.0.0 and MongoDB C Driver version 2.0.1

    MAMongoDB Atlas· Apr 13, 2026

50. 6.0Med

    CVE-2026-5170 ↗ (opens in a new tab)

    A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window when the cluster is being promoted from a replica set to a sharded cluster. This may cause a denial of service by taking down the primary of the replica set. This issue affects MongoDB Server v8.2 versions prior to 8.2.2, MongoDB Server v8.0 versions between 8.0.18, MongoDB Server v7.0 versions between 7.0.31.

    MAMongoDB Atlas· Mar 30, 2026