Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 134

Export CSV
CVE-2026-120821

Post-authentication use-after-free in MongoDB Server aggregation sub-pipelines

A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipeline. The condition can be caused by an authenticated user with read privileges, and may result in the server terminating unexpectedly.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-120822

Missing Authorization Check in MongoDB Server Replication-Related Administrative Command Leads to Unauthorized Data Access

MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read and relocate collections outside the set that user is permitted to access. This may result in unintended access to data and unintended changes to the collection catalog.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-120824

Post-authentication use-after-free in MongoDB Server time-series bucket validation

A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directly, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-120825

Improper Authorization in MongoDB Server Aggregation Framework View Definition Validation Leads to Unauthorized Collection Access

An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-120819

Use-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulator

A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted database command that runs user-supplied JavaScript, the user can cause a bounded amount of adjacent process memory to be returned in the command's result. This results in the user obtaining information they are not authorized to access. Integrity and availability are not affected.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-118383

Pre-authentication use-after-free in MongoDB Server replica set primary catch-up

A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-104005

Incorrect authorization in MongoDB Server router for bulk writes to system namespaces

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-104004

Collection validators using collation-accepting expressions can crash MongoDB Server on insert

MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-96299

Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization checks despite being intended for internal use, allowing a subsequent stage to be forced to execute on the router under conditions it was not designed to handle. This results in an unhandled fatal error that causes the mongos process to immediately abort, resulting in denial of service for all clients routed through the affected mongos instance.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-96297

MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline

Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelated data from the server process. Depending on the state of memory at the time, the server process may also terminate unexpectedly. The behavior can occur when an authenticated user with read privileges runs an aggregate command that combines these two settings.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-103965

Fixed values in MongoDB Server $bucket stage may be misread as field references

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Server
CVE-2026-9737

Find command with $meta sort can lead to crash

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-89099

Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption

A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of process memory with user-influenced content. Successful use of this issue may impact the confidentiality, integrity, and availability of the affected server process.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-18711

Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure

An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query results.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-18712

Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-18710

Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Java Driver Mongodb Server
CVE-2026-8843

Calling createIndex with certain index types can crash mongod

Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices. This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-13062

MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-13060

$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2026-82052

$regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the  regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server