mongodb/mongodb vulnerabilities

Latest mongodb/mongodb CVEs

Newest publication first · page 1 of 8

1. CVE-2026-118383 Pre-authentication use-after-free in MongoDB Server replica set primary catch-up

   Published 2026-11-10

   Critical·CVSS 9.5 EPSS 0.71%

   A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certa...

2. CVE-2026-89099 Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption

   Published 2026-09-11

   High·CVSS 7.7 EPSS 0.32%

   A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able...

3. CVE-2026-88023 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

   Published 2026-09-10

   Medium·CVSS 6.1 EPSS 0.33%

   Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can infl...

4. CVE-2026-82076 Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server

   Published 2026-09-08

   High·CVSS 7.1 EPSS 0.41%

   An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound du...

5. CVE-2026-82075 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service

   Published 2026-09-08

   High·CVSS 8.7 EPSS 0.52%

   An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend...

6. CVE-2026-82074 Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data

   Published 2026-09-08

   High·CVSS 7.1 EPSS 0.36%

   MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than...

7. CVE-2026-82073 Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search

   Published 2026-09-08

   High·CVSS 7.1 EPSS 0.36%

   A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient...

8. CVE-2026-82071 Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write

   Published 2026-09-08

   High·CVSS 7.2 EPSS 0.54%

   Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in t...

9. CVE-2026-82070 Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface

   Published 2026-09-08

   High·CVSS 7.1 EPSS 0.33%

   A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, b...

10. CVE-2026-82069 Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router

    Published 2026-09-08

    Medium·CVSS 5.1 EPSS 0.41%

    A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechan...

11. CVE-2026-82068 Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service

    Published 2026-09-08

    High·CVSS 7.1 EPSS 0.40%

    A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on resta...

12. CVE-2026-82067 Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup

    Published 2026-09-08

    Critical·CVSS 9.2 EPSS 0.51%

    Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition oc...

13. CVE-2026-82066 Heap Out-of-Bounds Read in MongoDB Server Query Planning Component

    Published 2026-09-08

    Medium·CVSS 5.3 EPSS 0.39%

    A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buf...

14. CVE-2026-82065 Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata

    Published 2026-09-08

    High·CVSS 7.1 EPSS 0.40%

    A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once per...

15. CVE-2026-82064 Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members

    Published 2026-09-08

    High·CVSS 8.7 EPSS 0.52%

    A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's a...

16. CVE-2026-82063 Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service

    Published 2026-09-08

    Medium·CVSS 6.0 EPSS 0.37%

    A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently derefere...

17. CVE-2026-82062 Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass

    Published 2026-09-08

    High·CVSS 7.0 EPSS 0.50%

    A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables executio...

18. CVE-2026-82061 Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service

    Published 2026-09-08

    High·CVSS 7.2 EPSS 0.53%

    A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential mem...

19. CVE-2026-82060 Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups

    Published 2026-09-08

    Low·CVSS 2.3 EPSS 0.34%

    In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed...

20. CVE-2026-82059 Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service

    Published 2026-09-08

    Medium·CVSS 6.0 EPSS 0.37%

    An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read...

21. CVE-2026-82057 Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service

    Published 2026-09-08

    High·CVSS 7.1 EPSS 0.42%

    A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type...

22. CVE-2026-82058 Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service

    Published 2026-09-08

    High·CVSS 7.1 EPSS 0.40%

    A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error ge...

23. CVE-2026-82056 Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service

    Published 2026-09-08

    Medium·CVSS 6.0 EPSS 0.33%

    A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structu...

24. CVE-2026-82054 Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service

    Published 2026-09-08

    High·CVSS 7.1 EPSS 0.40%

    A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total...

25. CVE-2026-82055 Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service

    Published 2026-09-08

    High·CVSS 7.1 EPSS 0.40%

    A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an int...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.