Mongodb Server (Mongodb) - vulnerabilities (CVEs)

95 CVEs, 5 in the last 30 days, 3 known versions, newest CVE from 2026-10-13. Vendor: Mongodb.

CVEs of Mongodb Server

CVE-2026-104005 - CVSS 7.1 (high), 2026-10-13: A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos…
CVE-2026-104004 - CVSS 7.1 (high), 2026-10-13: MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server…
CVE-2026-103965 - CVSS 5.4 (medium), 2026-10-13: An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain…
CVE-2026-96299 - CVSS 7.1 (high), 2026-10-13: A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos…
CVE-2026-96297 - CVSS 6.5 (medium), 2026-10-13: Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an…
CVE-2026-89099 - CVSS 7.7 (high), 2026-09-11: A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without…
CVE-2026-82076 - CVSS 7.1 (high), 2026-09-08: An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to…
CVE-2026-82075 - CVSS 8.7 (high), 2026-09-08: An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network…
CVE-2026-82074 - CVSS 7.1 (high), 2026-09-08: MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a…
CVE-2026-82073 - CVSS 7.1 (high), 2026-09-08: A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization…
CVE-2026-82071 - CVSS 8.1 (high), 2026-09-08: Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted…
CVE-2026-82070 - CVSS 7.1 (high), 2026-09-08: A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected…
CVE-2026-82069 - CVSS 6.5 (medium), 2026-09-08: A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query…
CVE-2026-82068 - CVSS 7.1 (high), 2026-09-08: A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially…
CVE-2026-82066 - CVSS 8.1 (high), 2026-09-08: A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write…
CVE-2026-82067 - CVSS 9.2 (critical), 2026-09-08: Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default…
CVE-2026-82065 - CVSS 7.1 (high), 2026-09-08: A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a…
CVE-2026-82064 - CVSS 8.7 (high), 2026-09-08: A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server…
CVE-2026-82063 - CVSS 6 (medium), 2026-09-08: A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific…
CVE-2026-82062 - CVSS 7 (high), 2026-09-08: A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by…
CVE-2026-82061 - CVSS 8.1 (high), 2026-09-08: A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a…
CVE-2026-82060 - CVSS 5.4 (medium), 2026-09-08: In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted,…
CVE-2026-82059 - CVSS 6.5 (medium), 2026-09-08: An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to…
CVE-2026-82057 - CVSS 7.1 (high), 2026-09-08: A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom…
CVE-2026-82058 - CVSS 7.1 (high), 2026-09-08: A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a…
CVE-2026-82056 - CVSS 6 (medium), 2026-09-08: A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent…
CVE-2026-82054 - CVSS 7.1 (high), 2026-09-08: A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially…
CVE-2026-82055 - CVSS 7.1 (high), 2026-09-08: A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted…
CVE-2026-82053 - CVSS 8.1 (high), 2026-09-08: A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user…
CVE-2026-82052 - CVSS 7.1 (high), 2026-09-08: The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain…
CVE-2026-18712 - CVSS 8.1 (high), 2026-08-11: An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to…
CVE-2026-18711 - CVSS 7.1 (high), 2026-08-11: An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used…
CVE-2026-18709 - CVSS 6.4 (medium), 2026-08-11: An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared…
CVE-2026-18698 - CVSS 5.4 (medium), 2026-08-11: An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections…
CVE-2026-18690 - CVSS 8.1 (high), 2026-08-11: An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections…
CVE-2026-18699 - CVSS 6.5 (medium), 2026-08-11: An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly…
CVE-2026-18691 - CVSS 9 (critical), 2026-08-11: An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is…
CVE-2026-18702 - CVSS 6.4 (medium), 2026-08-11: An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the…
CVE-2026-18694 - CVSS 7.1 (high), 2026-08-11: An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to…
CVE-2026-18708 - CVSS 6.4 (medium), 2026-08-11: An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed…
CVE-2026-18696 - CVSS 7 (high), 2026-08-11: An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition…
CVE-2026-18700 - CVSS 6.5 (medium), 2026-08-11: An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the…
CVE-2026-18701 - CVSS 7.1 (high), 2026-08-11: An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by…
CVE-2026-18697 - CVSS 8.7 (high), 2026-08-11: An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by…
CVE-2026-18693 - CVSS 7.6 (high), 2026-08-11: An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to…
CVE-2026-18705 - CVSS 7.1 (high), 2026-08-11: An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a…
CVE-2026-18704 - CVSS 7.1 (high), 2026-08-11: An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections…
CVE-2026-18692 - CVSS 8.8 (high), 2026-08-11: An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to…
CVE-2026-18688 - CVSS 7.1 (high), 2026-08-11: An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed…
CVE-2026-18695 - CVSS 7.1 (high), 2026-08-11: An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with…
CVE-2026-18687 - CVSS 7.1 (high), 2026-08-11: MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's…
CVE-2026-18706 - CVSS 7.5 (high), 2026-08-11: An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to…
CVE-2026-18707 - CVSS 5.3 (medium), 2026-08-11: An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly…
CVE-2026-18703 - CVSS 4.2 (medium), 2026-08-11: An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based…
CVE-2026-13055 - CVSS 7.1 (high), 2026-07-22: The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle…
CVE-2026-13056 - CVSS 7.1 (high), 2026-07-22: Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to…
CVE-2026-13057 - CVSS 6.5 (medium), 2026-07-22: An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and…
CVE-2026-13058 - CVSS 7.1 (high), 2026-07-22: An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an…
CVE-2026-13059 - CVSS 8.6 (high), 2026-07-22: An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls,…
CVE-2026-9737 - CVSS 7.1 (high), 2026-07-22: During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to…
CVE-2026-13060 - CVSS 7.1 (high), 2026-07-22: An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency…
CVE-2026-13061 - CVSS 5.3 (medium), 2026-07-22: An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This…
CVE-2026-13062 - CVSS 7.1 (high), 2026-07-22: An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are…
CVE-2026-13063 - CVSS 6.5 (medium), 2026-07-22: An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted…
CVE-2026-13064 - CVSS 7.1 (high), 2026-07-22: Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments,…
CVE-2026-13065 - CVSS 7.1 (high), 2026-07-22: A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression…
CVE-2026-13066 - CVSS 7.1 (high), 2026-07-22: Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents…
CVE-2026-13067 - CVSS 7.2 (high), 2026-07-22: When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured…
CVE-2026-13068 - CVSS 4.3 (medium), 2026-07-22: An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database,…
CVE-2026-13069 - CVSS 7.1 (high), 2026-07-22: An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find…
CVE-2026-13070 - CVSS 6 (medium), 2026-07-22: A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS…
CVE-2026-13071 - CVSS 7.1 (high), 2026-07-22: An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side…
CVE-2026-13072 - CVSS 9.2 (critical), 2026-07-22: When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing…
CVE-2026-13073 - CVSS 5.3 (medium), 2026-07-22: An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in…
CVE-2026-13074 - CVSS 6.9 (medium), 2026-07-22: An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable…
CVE-2026-13075 - CVSS 7.1 (high), 2026-07-22: An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion…
CVE-2026-13076 - CVSS 7.1 (high), 2026-07-22: An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type…
CVE-2026-13077 - CVSS 7.1 (high), 2026-07-22: A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline.…
CVE-2026-13078 - CVSS 7.7 (high), 2026-07-22: A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables…
CVE-2026-9747 - CVSS 7.1 (high), 2026-06-09: Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.
CVE-2026-9750 - CVSS 7.1 (high), 2026-06-09: An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing…
CVE-2026-9753 - CVSS 8.1 (high), 2026-06-09: The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory…
CVE-2026-9749 - CVSS 7.1 (high), 2026-06-09: This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving…
CVE-2026-9752 - CVSS 7.1 (high), 2026-06-09: An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a…
CVE-2026-9748 - CVSS 7.1 (high), 2026-06-09: The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But…
CVE-2026-9751 - CVSS 6.8 (medium), 2026-06-09: The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.
CVE-2026-9735 - CVSS 6.8 (medium), 2026-06-09: MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging…
CVE-2026-9742 - CVSS 8.2 (high), 2026-06-09: When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to…
CVE-2026-9741 - CVSS 7.1 (high), 2026-06-09: A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results…
CVE-2026-9746 - CVSS 7.1 (high), 2026-06-09: When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are…
CVE-2026-9740 - CVSS 8.7 (high), 2026-06-09: A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message.…
CVE-2026-9743 - CVSS 7.1 (high), 2026-06-09: In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued…
CVE-2026-6915 - CVSS 6.3 (medium), 2026-04-29: An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with…
CVE-2026-6914 - CVSS 7.5 (high), 2026-04-29: Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all…
CVE-2026-5170 - CVSS 6 (medium), 2026-03-30: A user with access to the cluster with a limited set of privilege actions can trigger a crash of a mongod process during the limited and unpredictable window…
CVE-2019-20923 - CVSS 6.5 (medium), 2020-11-23: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions…