CVE-2026-4147

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4147", "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "state": "PUBLISHED", "assignerShortName": "mongodb", "dateReserved": "2026-03-13T17:18:01.671Z", "datePublished": "2026-03-17T15:50:21.888Z", "dateUpdated": "2026-03-17T16:09:55.480Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "shortName": "mongodb", "dateUpdated": "2026-03-17T15:50:21.888Z"}, "title": "Stack memory disclosure in filemd5 command", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-457", "description": "CWE-457 Use of uninitialized variable", "type": "CWE"}]}], "affected": [{"vendor": "MongoDB Inc", "product": "MongoDB Server", "versions": [{"status": "affected", "version": "8.2", "lessThan": "8.2.6", "versionType": "custom"}, {"status": "affected", "version": "8.0", "lessThan": "8.0.20", "versionType": "custom"}, {"status": "affected", "version": "7.0", "lessThan": "7.0.31", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.&nbsp;<br>"}]}], "references": [{"url": "https://jira.mongodb.org/browse/SERVER-119317"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-17T16:09:49.984101Z", "id": "CVE-2026-4147", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T16:09:55.480Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4147", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-17T16:09:49.984101Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T16:09:52.279Z"}}], "cna": {"title": "Stack memory disclosure in filemd5 command", "source": {"discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MongoDB Inc", "product": "MongoDB Server", "versions": [{"status": "affected", "version": "8.2", "lessThan": "8.2.6", "versionType": "custom"}, {"status": "affected", "version": "8.0", "lessThan": "8.0.20", "versionType": "custom"}, {"status": "affected", "version": "7.0", "lessThan": "7.0.31", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://jira.mongodb.org/browse/SERVER-119317"}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.", "supportingMedia": [{"type": "text/html", "value": "An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.&nbsp;<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-457", "description": "CWE-457 Use of uninitialized variable"}]}], "providerMetadata": {"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "shortName": "mongodb", "dateUpdated": "2026-03-17T15:50:21.888Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4147", "state": "PUBLISHED", "dateUpdated": "2026-03-17T16:09:55.480Z", "dateReserved": "2026-03-13T17:18:01.671Z", "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb", "datePublished": "2026-03-17T15:50:21.888Z", "assignerShortName": "mongodb"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MongoDB Server", "vendor": "MongoDB Inc", "versions": [{"lessThan": "8.2.6", "status": "affected", "version": "8.2", "versionType": "custom"}, {"lessThan": "8.0.20", "status": "affected", "version": "8.0", "versionType": "custom"}, {"lessThan": "7.0.31", "status": "affected", "version": "7.0", "versionType": "custom"}]}], "source": "cna@mongodb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*", "matchCriteriaId": "20BB1767-F789-4A09-BB6F-00B535AEDC02", "versionEndExcluding": "7.0.31", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*", "matchCriteriaId": "343C4216-8507-44B6-B692-7A7B66455402", "versionEndExcluding": "8.0.20", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*", "matchCriteriaId": "5A773422-F80B-477C-BD39-1DE25E94BADD", "versionEndExcluding": "8.2.6", "versionStartIncluding": "8.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:mongodb:8.3.0:alpha0:*:*:-:*:*:*", "matchCriteriaId": "CC3B9A35-1714-4DF1-ACB5-123A596461D6", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:mongodb:8.3.0:alpha1:*:*:-:*:*:*", "matchCriteriaId": "0CB39287-3FBC-4DAB-B6C3-A4BD59251BE8", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:mongodb:8.3.0:alpha2:*:*:-:*:*:*", "matchCriteriaId": "7ADCCBAC-CCBA-470E-9E47-049F69806766", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:mongodb:8.3.0:alpha3:*:*:-:*:*:*", "matchCriteriaId": "B5789644-2C9E-430F-A7C2-C36F103F8546", "vulnerable": true}, {"criteria": "cpe:2.3:a:mongodb:mongodb:8.3.0:rc1:*:*:-:*:*:*", "matchCriteriaId": "17C57EBD-CBE7-4F31-8B75-BC4EBF5FCCCA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command."}, {"lang": "es", "value": "Un usuario autenticado con el rol de lectura puede leer cantidades limitadas de memoria de pila no inicializada a trav\u00e9s de invocaciones especialmente dise\u00f1adas del comando filemd5."}], "id": "CVE-2026-4147", "lastModified": "2026-06-17T10:56:03.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "cna@mongodb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@mongodb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4147", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-17T16:09:49.984101Z", "version": "2.0.3"}}]}, "published": "2026-03-17T16:16:23.497", "references": [{"source": "cna@mongodb.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://jira.mongodb.org/browse/SERVER-119317"}], "sourceIdentifier": "cna@mongodb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-457"}], "source": "cna@mongodb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-908"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.2,8.2.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.0,8.0.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0,7.0.31)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "MongoDB Server", "source": "cna", "vendor": "MongoDB Inc"}, "product": "mongodb_server", "vendor": "mongodb"}], "analysis": {"en": {"generated_at": "2026-04-10T18:30:12.306219+00:00", "value": {"mitigation_remediation": ["Apply the latest official MongoDB patch addressing SERVER\u2011119317", "Revoke or restrict read role privileges for users that do not require them", "Limit usage of the filemd5 command in automated scripts or applications", "Monitor system logs for anomalous filemd5 activity", "Contact MongoDB support for guidance if the patch cannot be applied immediately"], "summary": {"action": "Apply Patch", "impact": "Information disclosure of internal stack data"}, "threat_synthesis": {"affected_systems": "MongoDB Server produced by MongoDB Inc is affected. The issue applies to releases starting with version 8.3.0 alpha0 through alpha3 and rc1, and to all other builds indicated by the general MongoDB product CPE. The vulnerability is documented in the MongoDB issue tracker as SERVER\u2011119317.", "description_and_impact": "The vulnerability allows an authenticated user with read-only privileges to exfiltrate uninitialized stack memory by issuing specially-crafted filemd5 commands. This flaw is a form of memory disclosure, enabling an attacker to glean internal state information that could contain sensitive details. The weakness is characterized by CWE\u2011457 and CWE\u2011908.", "risk_and_exploitability": "The CVSS score of 7.1 indicates a high severity impact, yet the EPSS score of under 1% suggests limited exploitation likelihood. The attacker must be authenticated with at least a read role to use the filemd5 command, so the vulnerability is not exploitable by anonymous users. The flaw is not listed in the CISA KEV catalog, implying no known widespread exploitation. Nevertheless, the potential for leaking internal data warrants prompt remediation."}}}}, "created": "2026-03-18T12:13:16.091416+00:00", "updated": "2026-04-13T14:28:27.133720+00:00", "vendors": ["mongodb", "mongodb$PRODUCT$mongodb_server"]}