CVEs.

Matching CVEs

1. 5.7Med

   CVE-2026-84962 ↗ (opens in a new tab)

   An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

   MAMongoDB Atlas· Sep 3, 2026

2. 7.1High

   CVE-2026-84971 ↗ (opens in a new tab)

   Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running.

   MAMongoDB Atlas· Sep 3, 2026

3. 5.9Med

   CVE-2026-84970 ↗ (opens in a new tab)

   A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.

   MAMongoDB Atlas· Sep 3, 2026

4. 6.3Med

   CVE-2026-84969 ↗ (opens in a new tab)

   A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.

   MAMongoDB Atlas· Sep 3, 2026

5. 6.0Med

   CVE-2026-81533 ↗ (opens in a new tab)

   An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length. A user able to influence the numeric portion of a LIMIT clause could cause the hosting application process to terminate unexpectedly or corrupt adjacent memory in that process.

   MAMongoDB Atlas· Aug 28, 2026

6. 8.7High

   CVE-2026-81532 ↗ (opens in a new tab)

   A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message, memory adjacent to that buffer is overwritten with user-supplied content. This can terminate the hosting application process and may allow unintended code to run within it.

   MAMongoDB Atlas· Aug 28, 2026

7. 8.7High

   CVE-2026-81520 ↗ (opens in a new tab)

   A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time bound and the read from the client had no deadline, each such session retains a worker, a client connection slot, and its associated backend database connections until the process is restarted. Repeated use of this behavior can consume the configured connection capacity and prevent legitimate users from establishing new sessions.

   MAMongoDB Atlas· Aug 28, 2026

8. 8.7High

   CVE-2026-81518 ↗ (opens in a new tab)

   When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of identifying users, a remote party with network access to the listener can therefore establish a session and read the MongoDB data exposed through the connector.

   MAMongoDB Atlas· Aug 28, 2026

9. 8.7High

   CVE-2026-81517 ↗ (opens in a new tab)

   An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operation subsequently fails, the resulting error is not handled and the shared mongosqld process ends, ending service for all connected SQL clients. The process continues to end on startup until an operator restores available storage, and the diagnostic message explaining the condition is not recorded.

   MAMongoDB Atlas· Aug 28, 2026

10. 8.3High

    CVE-2026-81490 ↗ (opens in a new tab)

    A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message as transient and, after the configured retries are exhausted, proceeds without a valid result, ending the schema refresh routine. The mongosqld process continues running without a usable schema, so SQL clients are unable to obtain results until an operator removes the view or excludes its namespace from sampling.

    MAMongoDB Atlas· Aug 28, 2026

11. 8.5High

    CVE-2026-77586 ↗ (opens in a new tab)

    In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write to a sampled MongoDB collection can choose a name that closes the quoted identifier early, so that additional SQL text becomes part of the generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.

    MAMongoDB Atlas· Aug 28, 2026

12. 5.7Med

    CVE-2026-77184 ↗ (opens in a new tab)

    In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in deployments configured to build their SQL schema from those validators, can cause additional SQL text to be embedded in that generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.

    MAMongoDB Atlas· Aug 28, 2026

13. 6.9Med

    CVE-2026-76798 ↗ (opens in a new tab)

    The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query is interpreted by the browser when an operator later generates and opens the report, which may disclose other users' logged query text and user names to an external party or present misleading content to the operator. Generating a report over logs containing the affected entries and opening that repor

    MAMongoDB Atlas· Aug 28, 2026

14. 5.8Med

    CVE-2026-76797 ↗ (opens in a new tab)

    The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a formula when an operator opens the generated report in a spreadsheet application, which may result in unintended disclosure of report contents or execution of external content on the operator's workstation. Generating a report for the affected namespace and opening it in a spreadsheet application is re

    MAMongoDB Atlas· Aug 28, 2026

15. 4.8Med

    CVE-2026-76794 ↗ (opens in a new tab)

    MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report contents or altering its display.

    MAMongoDB Atlas· Aug 28, 2026

16. 6.8Med

    CVE-2026-81530 ↗ (opens in a new tab)

    A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked as other secret fields are. A party able to read the application's logs, diagnostic output, or a process memory dump may thereby recover the plaintext credentials and use them to decrypt protected field data.

    MAMongoDB Atlas· Aug 27, 2026

17. 7.1High

    CVE-2026-81529 ↗ (opens in a new tab)

    Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.

    MAMongoDB Atlas· Aug 27, 2026

18. 5.3Med

    CVE-2026-81528 ↗ (opens in a new tab)

    A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.

    MAMongoDB Atlas· Aug 27, 2026

19. 6.9Med

    CVE-2026-81527 ↗ (opens in a new tab)

    A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended d

    MAMongoDB Atlas· Aug 27, 2026

20. 7.1High

    CVE-2026-81526 ↗ (opens in a new tab)

    The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended target within the same deployment using the application's own credentials. This may result in unauthorized modification of data belonging to another logical boundary enforced by the application.

    MAMongoDB Atlas· Aug 27, 2026

21. 8.6High

    CVE-2026-81525 ↗ (opens in a new tab)

    The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended.

    MAMongoDB Atlas· Aug 27, 2026

22. 5.3Med

    CVE-2026-81524 ↗ (opens in a new tab)

    A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.

    MAMongoDB Atlas· Aug 27, 2026

23. 2.0Low

    CVE-2026-81523 ↗ (opens in a new tab)

    A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.

    MAMongoDB Atlas· Aug 27, 2026

24. 8.6High

    CVE-2026-81522 ↗ (opens in a new tab)

    A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

    MAMongoDB Atlas· Aug 27, 2026

25. 7.1High

    CVE-2026-81521 ↗ (opens in a new tab)

    The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client.BulkWrite API is affected.

    MAMongoDB Atlas· Aug 27, 2026

26. 4.1Med

    CVE-2026-75573 ↗ (opens in a new tab)

    In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclosed password to access the associated TLS client key.

    MAMongoDB Atlas· Aug 27, 2026

27. 8.2High

    CVE-2026-75159 ↗ (opens in a new tab)

    An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until the process restarts.

    MAMongoDB Atlas· Aug 27, 2026

28. 8.4High

    CVE-2026-19003 ↗ (opens in a new tab)

    A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running th

    MAMongoDB Atlas· Aug 12, 2026

29. 6.3Med

    CVE-2026-19503 ↗ (opens in a new tab)

    MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.

    MAMongoDB Atlas· Aug 12, 2026

30. 6.8Med

    CVE-2026-19502 ↗ (opens in a new tab)

    MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.

    MAMongoDB Atlas· Aug 12, 2026

31. 8.8High

    CVE-2026-19004 ↗ (opens in a new tab)

    An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.

    MAMongoDB Atlas· Aug 12, 2026

32. 8.8High

    CVE-2026-19002 ↗ (opens in a new tab)

    A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.

    MAMongoDB Atlas· Aug 12, 2026

33. 9.5Crit

    CVE-2026-19001 ↗ (opens in a new tab)

    The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.

    MAMongoDB Atlas· Aug 12, 2026

34. 7.1High

    CVE-2026-18888 ↗ (opens in a new tab)

    The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.

    MAMongoDB Atlas· Aug 12, 2026

35. 8.2High

    CVE-2026-18710 ↗ (opens in a new tab)

    A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.

    MAMongoDB Atlas· Aug 11, 2026

36. 7.2High

    CVE-2026-18712 ↗ (opens in a new tab)

    An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.

    MAMongoDB Atlas· Aug 11, 2026

37. 7.1High

    CVE-2026-18711 ↗ (opens in a new tab)

    An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query results.

    MAMongoDB Atlas· Aug 11, 2026

38. 5.9Med

    CVE-2026-18709 ↗ (opens in a new tab)

    An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.

    MAMongoDB Atlas· Aug 11, 2026

39. 5.3Med

    CVE-2026-18708 ↗ (opens in a new tab)

    An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.

    MAMongoDB Atlas· Aug 11, 2026

40. 5.3Med

    CVE-2026-18707 ↗ (opens in a new tab)

    An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.

    MAMongoDB Atlas· Aug 11, 2026

41. 7.5High

    CVE-2026-18706 ↗ (opens in a new tab)

    An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.

    MAMongoDB Atlas· Aug 11, 2026

42. 7.1High

    CVE-2026-18705 ↗ (opens in a new tab)

    An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.

    MAMongoDB Atlas· Aug 11, 2026

43. 7.1High

    CVE-2026-18704 ↗ (opens in a new tab)

    An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.

    MAMongoDB Atlas· Aug 11, 2026

44. 2.3Low

    CVE-2026-18703 ↗ (opens in a new tab)

    An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intended to disable.

    MAMongoDB Atlas· Aug 11, 2026

45. 5.3Med

    CVE-2026-18702 ↗ (opens in a new tab)

    An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitoring by causing excessive log volume.

    MAMongoDB Atlas· Aug 11, 2026

46. 7.1High

    CVE-2026-18701 ↗ (opens in a new tab)

    An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.

    MAMongoDB Atlas· Aug 11, 2026

47. 6.0Med

    CVE-2026-18700 ↗ (opens in a new tab)

    An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service.

    MAMongoDB Atlas· Aug 11, 2026

48. 6.0Med

    CVE-2026-18699 ↗ (opens in a new tab)

    An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connected clients and in-flight operations.

    MAMongoDB Atlas· Aug 11, 2026

49. 5.3Med

    CVE-2026-18698 ↗ (opens in a new tab)

    An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations, unauthorized modification of system collection data.

    MAMongoDB Atlas· Aug 11, 2026

50. 8.7High

    CVE-2026-18697 ↗ (opens in a new tab)

    An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.

    MAMongoDB Atlas· Aug 11, 2026