CVE-2026-120820

Uncontrolled Resource Consumption in MongoDB Server Per-Namespace Encrypted-Field Statistics Table Leads to Denial of Service

MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are created for any namespace supplied in a request, with no limit on the number of entries and no way to remove entries that never corresponded to a real collection. A user with basic read privileges who repeatedly issues ordinary read commands referencing arbitrary namespace names may cause the server process to retain steadily increasing amounts of memory and to slow down on the affected code path; the memory is reclaimed only by restarting the process.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120821

Post-authentication use-after-free in MongoDB Server aggregation sub-pipelines

A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipeline. The condition can be caused by an authenticated user with read privileges, and may result in the server terminating unexpectedly.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120822

Missing Authorization Check in MongoDB Server Replication-Related Administrative Command Leads to Unauthorized Data Access

MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read and relocate collections outside the set that user is permitted to access. This may result in unintended access to data and unintended changes to the collection catalog.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120824

Post-authentication use-after-free in MongoDB Server time-series bucket validation

A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directly, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120825

Improper Authorization in MongoDB Server Aggregation Framework View Definition Validation Leads to Unauthorized Collection Access

An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120819

Use-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulator

A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted database command that runs user-supplied JavaScript, the user can cause a bounded amount of adjacent process memory to be returned in the command's result. This results in the user obtaining information they are not authorized to access. Integrity and availability are not affected.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-118383

Pre-authentication use-after-free in MongoDB Server replica set primary catch-up

A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Server

CVE-2026-120959

MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-array stride, causing out-of-bounds writes

A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buffer provided by the calling application. A party able to influence the values a query returns may cause data to be placed at an unintended location in the client application's memory, which may result in unintended modification of that memory or termination of the client process. Reaching this condition depends on a specific, application-chosen way of requesting several result rows at once.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Atlas Sql

CVE-2026-120952

MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds write

An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Atlas Sql Odbc Driver

CVE-2026-120567

EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference

The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an aggregation pipeline, and a caller-supplied string beginning with $ is evaluated as an expression rather than stored as data. A party who can influence such a value may modify or remove fields in the records being updated, or copy other fields of the same record into them.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Entity Framework Core Provider

CVE-2026-118510

Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs

A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Laravel Mongodb

CVE-2026-118581

NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in such a document and uses it as part of a command can therefore emit a structurally inconsistent message, causing the database to interpret attacker-supplied trailing content as additional fields of the surrounding command. No authentication to the driver or database is required beyond the ability to influence those bytes through the victim application, and no user interaction is needed. The result is unintended modification of the command actually executed, which can alter the data read or written under the application's credentials.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Java Driver

CVE-2026-120684

MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password

A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C Driver

CVE-2026-120678

MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)

A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C Driver

CVE-2026-120673

Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Rust Driver

CVE-2026-120956

remote abort and memory disclosure from a malformed cursor.ns

The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C Driver

CVE-2026-120955

MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata

The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C Driver

CVE-2026-120954

Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views

A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to parse the data. The impact is limited to data integrity; memory safety is not affected and no information is disclosed.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C Driver

CVE-2026-119672

mongofiles may disclose GridFS content to standard output through a stored filename

MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard output instead of a local file. If standard output is captured in a location accessible to that user, this may disclose GridFS content the user cannot read directly. Exploitation requires a higher-privileged operator to retrieve the affected file without an explicit local destination and attacker access to the captured output. This issue affects MongoDB Database Tools from version 3.1.4 through versions before 100.20.1.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Database Tools

CVE-2026-119673

mongofiles may write outside the working directory through a symlink

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process's filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.

CVSS 4.0 · 1 Low EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Database Tools