CVE-2026-119675

mongorestore may bypass collection guards through a system.buckets prefix

MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Database Tools

CVE-2026-119673

mongofiles may write outside the working directory through a symlink

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process's filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.

CVSS 4.0 · 1 Low EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Database Tools

CVE-2026-115930

MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs

The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongosh

CVE-2026-115929

MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs

MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Compass

CVE-2026-114646

NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the amount of data actually provided, and it copies the data onto the wire unchanged. An unauthenticated party who can supply binary content to such an application can thereby cause additional elements to be inserted into, or existing elements to be removed from, the database command the application issues, without needing any database credentials of their own. This can result in unauthorized modification of stored data and disclosure of data outside the intended scope of the application's request, bounded by the database privileges the application itself holds.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver

CVE-2026-114644

Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization

The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver

CVE-2026-114643

Duplicate geometry fields via unvalidated GeoJSON extra members

The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the server and the driver resolve different values for the same record. Affected records can also become unreadable through the driver, interrupting application code that reads them.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver

CVE-2026-114650

Plaintext exposure of encrypted fields via ANSI code-page corruption of database name

A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer fails to associate the operation with its configured encryption rules and the operation proceeds without an error being raised. An application user with the ability to write data through an affected application can therefore have sensitive fields persisted in plaintext, defeating the confidentiality guarantee that client-side encryption is intended to provide. No integrity or availability impact was observed.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver Mongodb.libmongocrypt Nuget Package

CVE-2026-114649

Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache

The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver

CVE-2026-114648

NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys

The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver

CVE-2026-114647

NoSQL operator injection via unvalidated replacement document in findOneAndReplace

The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver

CVE-2026-114655

KMS request injection via unsanitized key vault and provider values in libmongocrypt

libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Libmongocrypt

CVE-2026-114654

BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards

A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire representation, producing binary elements that misdeclare their type or length. An unauthenticated party able to supply text parsed by an affected application can cause it to emit and persist malformed binary data, which subsequent readers either reject with an error or silently interpret as shorter than the data that was validated.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver

CVE-2026-114653

Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder

A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the stored data — without possession of the encryption keys — can observe the unprotected values.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver

CVE-2026-114652

Update operator injection via single-element list rewriting in the update builder

A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the application passes into the affected builder surface, without any special privilege beyond ordinary read-write application access, may cause stored data to be modified or removed in ways the application never intended. The result is unauthorized integrity impact on the affected application data; there is no direct loss of confidentiality or availability of the database service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver

CVE-2026-114651

Cross-document data leak via malformed BSON array parsing in reused thread buffer

A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps certain primitive collection types can cause residual bytes from unrelated data processed earlier on the same execution thread to be surfaced as legitimate values. This can result in disclosure of a limited amount of information belonging to other requests or principals of the consuming application. No authentication or special privileges within the application are required.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver

CVE-2026-113870

Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Compass

CVE-2026-116641

The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs

The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check. The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Database Tools

CVE-2026-114645

Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping

A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side configuration, in conjunction with the affected authentication mechanism, can cause the driver to write outside the bounds of the allocated buffer. This may result in corruption of client process memory and denial of service of the client application. The issue affects only client builds compiled with the Windows-native authentication backend.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C Driver

CVE-2026-106433

Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Libmongocrypt