Snapshot 256797

Document

Security advisories

URL

https://www.mongodb.com/resources/products/alerts

Fetched

2026-11-11 18:19:21 UTC

HTTP status

200

Content type

text/html; charset=utf-8

Fetch mode

static

Size

1518649 bytes

SHA-256 (raw)

40a497bb84c2c5635a52df7460d32dacc8eb9429169fb32941a0bf1d451fc39d

SHA-256 (normalized text)

9046d30b7015506bfe156579641325b42333b694e325a9bca91f69080b16b5c0

Normalized text

Scripts and page chrome removed; this is what change detection compares.

BLOGRun AI wherever your compliance framework demands. Read blog > >>
BLOGRetrieval accuracy is now a competitive advantage Read blog > >>
MongoDB Alerts
This page lists critical alerts and advisories for MongoDB. See the MongoDB JIRA for a comprehensive list of bugs and feature requests.
RSS Feed
Data integrity related
Operations Related
Security Related
General
Data Integrity Related
10/15/2026
In sharded clusters, renaming a collection to a different database (a cross-database rename) targeting a namespace that does not already exist can, if the operation is interrupted (e.g., by a primary step-down) at one specific point, result in the complete and permanent loss of the source collection's data. The rename command reports success even when this occurs. This only affects unsharded source collections, and does not apply to same-database renames or renames onto an already-existing destination.
MONGODB VERSIONS AFFECTED:
5.0.0 - 5.0.34
6.0.0 - 6.0.29
7.0.0 - 7.0.43
8.0.0 - 8.0.32
8.3.0 - 8.3.11
Reference Link →
06/17/2026
Queries against clustered collections with a descending sort on the _id field of the form {$lt: A}, {$gt: A}, {$gte: A, $lt: B}, {$gt: A, $lte: B}, can incorrectly included or excluded documents at the boundary of the defined range. This does not affect time series collections (despite time series using clustered collections), queries on non-clustered collections, queries on clustered collections that do not apply a descending sort on _id, or queries using two comparison operators of the same type (either both inclusive: $gte/$lte, or both exclusive: $gt/$lt).
MONGODB VERSIONS AFFECTED:
8.0.0 - 8.0.23
8.2.0 - 8.2.9
8.3.0 - 8.3.2
Reference Link →
05/14/2026
In sharded clusters, a unique index with a non-simple collation (e.g. case-insensitive) whose shard key equals or is a strict prefix of the index key pattern does not enforce uniqueness across shards. Different shards can independently accept documents with byte-distinct but collation-equivalent values (e.g. "YES" and "yes"), silently breaking uniqueness guarantees. This requires two or more shards, a unique index with a non-simple collation, and the shard key equals or is a strict prefix of the index key pattern.
MONGODB VERSIONS AFFECTED:
5.0.0 - 5.0.32
6.0.0 - 6.0.28
7.0.0 - 7.0.31
8.0.0 - 8.0.20
8.2.0 - 8.2.6
Reference Link →
05/14/2026
For users that have migrated with Relational Migrator: Sharded cluster migrations with embedded documents or embedded arrays may cause missing documents; Cyclic mappings with an excluded foreign key under an embedded array will be missing; A source table column used in multiple composite foreign key relationships can cause mismatched embeddings; Conflicting field name choices can cause omitted and mis-named fields.
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Relational Migrator prior to 1.16.0
Reference Link →
05/14/2026
When connecting directly to shard nodes instead of through mongos (including during a replica set promotion to sharded cluster), cluster-wide default read/write concerns may not be honored, causing writes to use {w: 1} instead of configured concerns, potentially losing acknowledged writes if rollback occurs. Users should connect to sharded clusters exclusively through mongos. If a direct connection to a shard is required, users should upgrade to patched versions immediately or specify explicit read and write concerns (e.g., {w: "majority"}) in connection strings.
MONGODB VERSIONS AFFECTED:
5.0.0 - 5.0.32
6.0.0 - 6.0.28
7.0.0 - 7.0.31
8.0.0 - 8.0.19
8.2.0 - 8.2.3
Reference Link →
03/17/2026
Sharded collections with a compound wildcard index that includes the shard key as a prefix may be at risk of data loss during chunk migrations. Documents may be left behind on the donor shard if they are missing all fields defined in the compound wildcard index, or if the index uses descending order (e.g., {skey: 1, "a.$**": -1}) and the document's shard key matches the min boundary of the migration.
MONGODB VERSIONS AFFECTED:
7.0.0 - 7.0.30
8.0.0 - 8.0.17
8.2.0 - 8.2.1
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server, MongoDB Atlas
Reference Link →
03/17/2026
Aggregation queries containing a $sort stage immediately followed by a $group stage with $top or $bottom accumulators can return incorrect results. This occurs when the query uses a compound index that satisfies the $sort pattern, but the accumulator's sort direction does not match the pipeline's $sort direction.
MONGODB VERSIONS AFFECTED:
8.0.0 - 8.0.19
8.2.0 - 8.2.3
OTHER TOOLS / PRODUCTS IMPACTED:
MongDB Server, MongoDB Atlas
Reference Link →
11/06/2026
The SQL Interface (Atlas and Enterprise Advanced) can return incorrect results when SQL queries contain a LEFT or RIGHT JOIN with a single equality condition, where one field is from the left datasource and the other from the right datasource, and the schema indicates both may evaluate to UNKNOWN (NULL or MISSING).
OTHER TOOLS / PRODUCTS IMPACTED:
SQL Interface (Atlas and Enterprise Advanced); JDBC 3.0.8 and earlier versions; ODBC 2.0.10 and earlier versions; MongoSQL versions between 1.1.0 and 1.8.7 (deployed on Atlas Data Federation)
Reference Link →
01/29/2026
Queries on a sharded collection which specify equalities on all fields of the sharding key and use any collation other than {locale: "simple"} may temporarily return duplicate records when chunks are being migrated between shards.
MONGODB VERSIONS AFFECTED:
6.0.0 - 6.0.27
7.0.0 - 7.0.28
8.0.0 - 8.0.12
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server, MongoDB Atlas
Reference Link →
11/20/2025
Under certain conditions, including a failover, a cross-shard transaction with apiVersion explicitly set may be partially committed while still being acknowledged as successfully completed to the client. This can lead to a torn transaction in versions v8.0–v8.0.12, or (in other affected versions) cause interruptions to subsequent operations on the documents affected by the transaction.
MONGODB VERSIONS AFFECTED:
5.0.0 - 5.0.31
6.0.0 - 6.0.26
7.0.0 - 7.0.25
8.0.0 - 8.0.15
8.2.0 - 8.2.1
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server, MongoDB Atlas
Reference Link →
11/20/2025
If a cluster undergoes a point-in-time (PIT) restore at a wall-clock time significantly after the TransactionRecordMinimumLifetimeMinutes timeout has elapsed, cross-shard transactions may be silently partially committed while still being acknowledged as successfully completed to the client. This can also occur in other rare conditions; see reference link for details.
MONGODB VERSIONS AFFECTED:
8.0.0 - 8.0.12
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server, MongoDB Atlas
Reference Link →
11/20/2025
2dsphere indexes on metric data in time series collections are not correctly maintained when inserting data into the time series collection. Index keys may not be generated and inserted into the index, causing geospatial queries optimized by it to return incomplete results.
MONGODB VERSIONS AFFECTED:
8.0.0 - 8.0.15
8.1.0 - 8.1.3
8.2.0 - 8.2.1
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server, MongoDB Atlas
Reference Link →
11/20/2025
When running on a standalone replica set while using queryable encryption or on a sharded cluster, write concern errors may be incorrectly suppressed when write errors occur (such as duplicate key errors or schema validation errors) or when the create command completes successfully (in a sharded cluster). This can cause applications to incorrectly assume that prior writes were durable, resulting in silent data loss. This can only occur if a primary failover and rollback subsequently occur.
MONGODB VERSIONS AFFECTED:
4.4.0 - 4.4.29
5.0.0 - 5.0.31
6.0.0 - 6.0.26
7.0.0 - 7.0.25
8.0.0 - 8.0.12
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server, MongoDB Atlas, Mongosync, Mongorestore, Mongoimport, Compass
Reference Link →
10/09/2025
Under certain situations, when running a join ($lookup, $graphLookup or $unionWith) in one database, followed by a $merge or $out written into another database, the join can read the wrong collection if the foreign collection of the join stage and the output collection of the $merge or $out stage have the same name. This will result in incorrect or missing results in the output collection.
MONGODB VERSIONS AFFECTED:
6.0 - 6.0.26
7.0 - 7.0.21
8.0 - 8.0.9
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server, MongoDB Atlas
Reference Link →
09/16/2025
When restoring from a backup, mongorestore silently ignores namespaces containing a newline character, without logging any warning messages. This affects mongorestore versions 3.3.11-100.12.1. Please upgrade to version 100.12.2 or later. This issue also affects namespaces containing newlines on Atlas Flex-tier backup snapshots, and Free-tier clusters that have been in a paused state. In both these scenarios, Atlas uses mongorestore behind the scenes and the fix has already been applied.
MONGODB VERSIONS AFFECTED:
3.3.11 - 100.12.1
OTHER TOOLS / PRODUCTS IMPACTED:
Atlas, mongorestore
Reference Link →
08/07/2025
Time series data can be corrupted if double-precision metrics are inserted in a pattern of multiple successive values with identical non-zero deltas, followed by a measurement where the metric is missing, into a time series collection for a specific meta value and adjacent time range.
MONGODB VERSIONS AFFECTED:
8.0.0 - 8.0.7
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
08/07/2025
Performing deletes on time-series collection with a non-metaField filter followed by inserts on an adjacent time range, can result in data inserted after the delete to be prematurely TTL expired and/or missing from query results.
MONGODB VERSIONS AFFECTED:
7.0.0 - 7.0.15
8.0.0 - 8.0.3
OTHER TOOLS / PRODUCTS IMPACTED:
Atlas, MongoDB Server
Reference Link →
07/16/2025
Combined alert for MongoDB Relational Migrator with multiple data integrity issues affecting data migrations from relational databases into MongoDB. These affect Snapshot migrations that contain specific mappings for cyclic dependency loops, ‘array-in-doc-in-array’ nested embeddings, or use of the idempotency user setting. These also affect Continuous (CDC) migrations.
MONGODB VERSIONS AFFECTED:
1.0.0 - 1.13.2
OTHER TOOLS / PRODUCTS IMPACTED:
Relational Migrator
Reference Link →
06/17/2025
Certain queries that involve an $elemMatch expression with string predicates may use an index with incompatible collation due to a plan cache bug. Impacted queries can return results which miss documents that should have been included. Write operations that rely on queries that incorrectly miss documents may not correctly update those documents. This includes updates, deletes, and $merge/$out aggregations with impacted query filters.
MONGODB VERSIONS AFFECTED:
6.0.0 - 6.0.23
7.0.0 - 7.0.20
8.0.0 - 8.0.9
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
04/28/2025
A bug, under certain circumstances, may cause a simple equality (non-_id) predicate query on sharded collections to report no results when a valid result exists.
MONGODB VERSIONS AFFECTED:
8.0 - 8.0.4
OTHER TOOLS / PRODUCTS IMPACTED:
Atlas, MongoDB Server
Reference Link →
03/19/2025
When enabling the useBigInt64 option (disabled by default) to deserialize a value through the bson JavaScript library (which is included in the MongoDB Node.js driver), negative Int64 values can be parsed as large positive values (greater than 9,223,372,036,854,775,807).
MONGODB VERSIONS AFFECTED:
bson library 6.4.0 - 6.10.2
MongoDB Node.js driver 6.0.0 - 6.13.0
Mongoose 8.3.5 - 8.10.1
MongoDB Shell 2.2.0 - 2.3.9
Compass 1.42.3-beta.4 - 1.45.3
VSCode Extension 1.6.1 - 1.12.0
OTHER TOOLS / PRODUCTS IMPACTED:
JavaScript bson library, MongoDB Node.js driver, MongoDB Shell, Compass, VS Code Extension
Reference Link →
03/03/2025
In certain situations, a resharded collection may have had retryable writes repeated on its documents multiple times.
MONGODB VERSIONS AFFECTED:
5.0.0 - 5.0.30
6.0.0 - 6.0.16
7.0.0 - 7.0.12
8.0.0 - 8.0.3
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
01/29/2025
Time Series collections may experience data loss when multiple documents are inserted concurrently with “ordered: false” and retryable writes are enabled.
MONGODB VERSIONS AFFECTED:
7.0.0 - 7.0.15
8.0.0 - 8.0.3
OTHER TOOLS / PRODUCTS IMPACTED:
Atlas, MongoDB Server
Reference Link →
01/29/2025
Performing a delete with a non-metadata filter on a time-series collection that is sharded on the time field may result in data loss.
MONGODB VERSIONS AFFECTED:
7.0.0 - 7.0.15
8.0.0 - 8.0.3
OTHER TOOLS / PRODUCTS IMPACTED:
Atlas, MongoDB Server
Reference Link →
12/11/2024
A reshardCollection operation on a cluster with at least two shards can potentially omit a collections catalog entry in a shards local catalog if a movePrimary operation had previously been issued on the same cluster. This impacts operations involving data migration that lookup the database cache namely movePrimary, reshardCollection, moveRange, and moveChunk.
MONGODB VERSIONS AFFECTED:
5.0.0 - 5.0.25
6.0.0 - 6.0.14
7.0.0 - 7.0.7
7.3.0 - 7.3.1
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
10/24/2024
Queries may return incomplete results when Time Series collections created prior to MongoDB 5.2 have been upgraded to MongoDB 6.0 or newer prior to those collections being cloned. Relatedly, Time Series collections on MongoDB Rapid Releases 7.1.0-7.3.3 that had their collection granularity changed via collMod while on those versions, may have also returned incomplete query results.
MONGODB VERSIONS AFFECTED:
6.0.0 - 6.0.16
7.0.0 - 7.0.12
7.1.0 - 7.3.3
OTHER TOOLS / PRODUCTS IMPACTED:
Atlas, MongoDB Server
Reference Link →
10/03/2024
"A bug can cause incorrect results or crashes when running certain aggregation pipelines containing $group and $lookup while on MongoDB Server version 6.0.17. "
MONGODB VERSIONS AFFECTED:
6.0.17
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
09/10/2024
The Node.js v22.7.0 runtime contains a regression related to its handling of UTF-8 encoding that can impact the data integrity of applications using the MongoDB Node.js driver. MongoDB does not use the affected Node.js version in any of its products, however, developers using MongoDB’s Node.js driver could experience data integrity issues when data is written to their clusters via the Node.js v22.7.0 runtime.
MONGODB VERSIONS AFFECTED:
Any MongoDB Node.js driver version if data was written using Node.js v22.7.0
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Node.js driver
Reference Link →
08/15/2024
To balance load and maintain a high quality of service, the Atlas Serverless system occasionally migrates data of serverless instances between different database servers. Certain multi-write, non-transactional database commands are not safely auto-retried by Atlas Serverless upon migration completion, which can lead to incorrect updates and deletes behavior.
MONGODB VERSIONS AFFECTED:
5.0+
OTHER TOOLS / PRODUCTS IMPACTED:
Atlas Serverless
Reference Link →
07/02/2024
"Issues during the initial data copy in mongosync 1.1.0 – 1.7.1 may lead to some writes or documents on the source not being replicated to the destination. Upgrade to mongosync version 1.7.2 or later. Atlas Live Migrate relies on mongosync for migrations to MongoDB 6.0+ and the fix has been applied to Atlas Live Migrate. "
MONGODB VERSIONS AFFECTED:
1.1.0 - 1.7.1
OTHER TOOLS / PRODUCTS IMPACTED:
Cluster-to-Cluster Sync (mongosync)
Reference Link →
04/15/2024
Issues affecting multi-document transactions on sharded clusters which can cause sharded multi-document transactions to return incorrect data and possibly miss writes.
MONGODB VERSIONS AFFECTED:
4.4.0 - 4.4.29
5.0.0 - 5.0.25
6.0.0 - 6.0.14
7.0.0 - 7.0.8
7.1.0 - 7.3.1
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
02/20/2024
An issue in mongodump can cause keys in collection options to be dumped in the wrong order. These alterations could change the result set returned by a view or change which documents are accepted by a validator.
MONGODB VERSIONS AFFECTED:
A fix has been released on Atlas, but free or shared clusters may have been impacted in the past.
Mongodump 4.2.0 - 100.9.0
OTHER TOOLS / PRODUCTS IMPACTED:
Atlas, Mongodump
Reference Link →
11/29/2023
An issue affecting inserts to Sharded Time Series collections can result in inserted documents on these collections to be immediately orphaned, leading to documents not being returned by queries and potential data loss.
MONGODB VERSIONS AFFECTED:
5.0.6 - 5.0.21
6.0.0 - 6.0.11
7.0.0 - 7.0.2
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
11/10/2023
A race condition in mongosync 1.5 can lead to some writes on the source not being replicated to the destination. Upgrade to version 1.6 or later.
MONGODB VERSIONS AFFECTED:
1.5.0
OTHER TOOLS / PRODUCTS IMPACTED:
Cluster-to-Cluster Sync (mongosync)
Reference Link →
05/23/2023
A storage engine issue can cause inconsistent incremental Ops Manager and Cloud Manager backups. Clusters restored from affected incremental backups can crash with checksum errors. Atlas customers/backups are not affected.
MONGODB VERSIONS AFFECTED:
4.4.8 - 4.4.21
5.0.2 - 5.0.17
6.0.0 - 6.0.5
OTHER TOOLS / PRODUCTS IMPACTED:
Ops Manager and Cloud Manager
Reference Link →
03/14/2023
A storage engine bug in MongoDB running on ARM64 or POWER architectures may store documents or index entries out of order, leading to inconsistencies and improperly sorted or incomplete query results.
MONGODB VERSIONS AFFECTED:
4.2.0 - 4.2.23
4.4.0 - 4.4.18
5.0.0 - 5.0.14
6.0.0 - 6.0.4
6.1.0 - 6.2.0
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
09/19/2022
A MongoDB agent issue in Atlas, Ops Manager, and Cloud Manager can cause automated "rolling index builds" to introduce index inconsistencies. MongoDB clusters on other platforms are not affected.
MONGODB VERSIONS AFFECTED:
MongoDB versions 4.2.19+, 4.4.13+, 5.0.6+, 5.1 - 5.3, and 6.0.0+ running on:
- Atlas - a fix has been released on Atlas, but clusters may have been impacted in the past.
- Ops Manager versions 5.0.10-5.0.14 and 6.0.0-6.0.2
- Cloud Manager running MongoDB Agent version from 11.13.0.7438-1 to 12.4.0.7702-1
OTHER TOOLS / PRODUCTS IMPACTED:
Atlas, Ops Manager, and Cloud Manager
Reference Link →
08/11/2022
A behavior change for improperly configured time-to-live (TTL) indexes can suddenly expire documents when upgrading to MongoDB 5.0 or 6.0 from version 4.4 or earlier.
MONGODB VERSIONS AFFECTED:
5.0.X
6.0.X
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
08/10/2022
A sharding metadata bug in MongoDB versions 5.0.0-5.0.10 and 6.0.0 can introduce corruption during a movePrimary command.
MONGODB VERSIONS AFFECTED:
5.0.0 - 5.0.10
6.0.0
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
11/12/2021
"A storage engine bug in MongoDB 4.4.3 and 4.4.4 can introduce corruption when upgrading to 4.4.8-4.4.10 or 5.0.2-5.0.5. It is safe to upgrade from versions 4.4.3 and 4.4.4 directly to 4.4.11+ or 5.0.6+ "1
MONGODB VERSIONS AFFECTED:
4.4.3
4.4.4
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
09/22/2021
A storage engine bug in MongoDB 4.4.2 - 4.4.8, and 5.0.0 - 5.0.2 can cause inconsistent data after an unclean shutdown and restart. Upgrade to version 4.4.9 or 5.0.3.
MONGODB VERSIONS AFFECTED:
4.4.2 - 4.4.8
5.0.0 - 5.0.2
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
09/22/2021
A storage engine bug in MongoDB 4.4.8 can cause inconsistent data after an unclean shutdown and restart. Upgrade to version 4.4.9
MONGODB VERSIONS AFFECTED:
4.4.8
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
08/06/2021
A storage engine bug in MongoDB 4.4.7, 5.0.0, and 5.0.1 allows some inserts to violate unique index constraints. Upgrade to version 4.4.8 or 5.0.2.
MONGODB VERSIONS AFFECTED:
4.4.7
5.0.0
5.0.1
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
05/19/2021
A storage engine bug in MongoDB 4.4.5 causes crashes on startup and may cause temporary query correctness issues. Upgrade to version 4.4.6.
MONGODB VERSIONS AFFECTED:
4.4.5
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
10/12/2020
Possible Corruption of Backup Snapshots on certain MongoDB 4.2+ Products
MONGODB VERSIONS AFFECTED:
4.2+
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
06/16/2020
Possible buffer overflow may result cause in-memory corruption on MongoDB 4.2.7 with incremental backup enabled.
MONGODB VERSIONS AFFECTED:
4.2.7
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
01/09/2020
A memory management bug can cause lost documents and index inconsistencies on replica set secondaries that restart during index builds.
MONGODB VERSIONS AFFECTED:
4.2.0
4.2.1
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
01/07/2020
When MongoDB recovers from an unclean shutdown, it is possible for the recovery process to corrupt documents that have received size-changing updates.
MONGODB VERSIONS AFFECTED:
3.6.14
3.6.15
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
09/23/2019
A memory management bug can cause failed operations, process crashes, and in-memory corruption of data that may be persisted to disk.
MONGODB VERSIONS AFFECTED:
4.2.0
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
02/22/2018
We have identified a bug in MongoDB Compass where modification or deletion of a document through Compass may occur on a different document than expected under certain specific conditions.
MONGODB VERSIONS AFFECTED:
1.3.x - 1.11.1
OTHER TOOLS / PRODUCTS IMPACTED:
Compass
Reference Link →
05/03/2016
While a background index build is in progress, document updates modifying fields contained in the index specification may, under specific circumstances, cause mismatched index entries to appear. This has an impact on queries that use affected indexes.
MONGODB VERSIONS AFFECTED:
3
3.2
OTHER TOOLS / PRODUCTS IMPACTED:
Indexing
Reference Link →
03/30/2016
During chunk migrations, insert and update operations affecting data within a migrating chunk are not reflected to the recipient shard, resulting in data loss.
MONGODB VERSIONS AFFECTED:
3.0.9
3.0.10
OTHER TOOLS / PRODUCTS IMPACTED:
Sharding
Reference Link →
12/16/2015
In a replica set, if a secondary node is shut down cleanly while replicating writes, the node may mark certain replicated operations as successfully applied even though they have not.
MONGODB VERSIONS AFFECTED:
3.2.0
OTHER TOOLS / PRODUCTS IMPACTED:
Replication
12/09/2015
A race condition in WiredTiger may prevent a write operation from becoming immediately visible to subsequent read operations, which may result in various problems, primarily impacting replication.
MONGODB VERSIONS AFFECTED:
3.0.0 - 3.0.7
OTHER TOOLS / PRODUCTS IMPACTED:
WiredTiger
Reference Link →
06/15/2015
Sharded clusters where the balancer is enabled (or there are manual chunk migrations), containing WiredTiger nodes that may become primary, may lose writes to a chunk being migrated if that chunk is under a heavy write load.
MONGODB VERSIONS AFFECTED:
3.0.0 - 3.0.3
OTHER TOOLS / PRODUCTS IMPACTED:
Sharding
Reference Link →
10/02/2014
MongoDB installations on certain 3.x Linux kernels running on VMWare and using virtual SCSI disks managed by LVM may see corruption in namespace (.ns) files.
MONGODB VERSIONS AFFECTED:
2.4.11
2.6.4
OTHER TOOLS / PRODUCTS IMPACTED:
Storage
08/03/2014
An update to a text-indexed field may fail to update the text index. As a result, a text search may not match the field contents, yielding incorrect search results.
MONGODB VERSIONS AFFECTED:
2.4.0 - 2.4.10
2.6.0
OTHER TOOLS / PRODUCTS IMPACTED:
Text Search
Reference Link →
01/01/2014
Under very rare circumstances mongos may incorrectly report a write as successful.
MONGODB VERSIONS AFFECTED:
2.2.0 - 2.2.6
2.4.0 - 2.4.8
OTHER TOOLS / PRODUCTS IMPACTED:
Sharding
10/21/2013
During a chunk migration in a sharded cluster, if one of the documents in the chunk has a size in the range of 16,776,185 and 16,777,216 bytes (inclusive), then some documents may be lost during the migration process
MONGODB VERSIONS AFFECTED:
2.2.0 - 2.2.5
2.4.0 - 2.4.4
OTHER TOOLS / PRODUCTS IMPACTED:
Sharding
Reference Link →
03/21/2013
Secondary indexes (i.e. all indexes other than _id) may be corrupted on an initial sync if write operations are performed on the sync source during the initial sync.
OTHER TOOLS / PRODUCTS IMPACTED:
Replication
Operations Related
01/22/2026
Major public Certificate Authorities are implementing policy requirements to stop issuing TLS certificates with client authentication (clientAuth) Extended Key Usage by April 2026. This industry-wide change only affects self-managed MongoDB deployments using mutual TLS (mTLS) or X.509 authentication with public CA certificates. Self-managed customers must migrate to private PKI infrastructure or reconfigure MongoDB before the April-May 2026 deadlines. Atlas customers are not affected.
MONGODB VERSIONS AFFECTED:
X.509 Cluster Authentication
X.509 Client Authentication
Mutual TLS (mTLS) with public CA certificates from Google Trust Services, Let's Encrypt, DigiCert, or Sectigo
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
09/30/2025
Third-party distributions of the MongoDB Shell, such as those installed by the Homebrew or npm package managers, can be affected by a Node.js REPL bug that may cause unintended side effects to occur during autocomplete.
MONGODB VERSIONS AFFECTED:
mongosh before version 2.5.8 in combination with Node.js versions 20.19.5 – 24.7.0
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Shell (“mongosh”)
Reference Link →
09/11/2025
When MongoDB is configured for FIPS mode on Linux operating systems which use OpenSSL 3 for cryptographic operations, MongoDB may use cryptographic algorithms from non-FIPS providers. This may allow clients to connect to a FIPS-mode MongoDB with TLS using non-FIPS-compliant cryptographic algorithms.
MONGODB VERSIONS AFFECTED:
6.0.0 - 6.0.25
7.0.0 - 7.0.22
8.0.0 - 8.0.12
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
10/29/2013
Caching of dbhash results may result in stale values, potentially causing disagreement among sharded cluster config servers.
MONGODB VERSIONS AFFECTED:
7.0.0 - 7.0.22
8.0.0 - 8.0.12
OTHER TOOLS / PRODUCTS IMPACTED:
MongoDB Server
Reference Link →
Security Related: Common Vulnerabilities and Exposures (CVEs)
RSS Feed
11/10/2026
CVE-2026-120819
5.3
Use-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulator
A memory-management flaw in the server-side JavaScript execution component of MongoDB Serv...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
Reference Link →
11/10/2026
CVE-2026-118383
9.5
Pre-authentication use-after-free in MongoDB Server replica set primary catch-up
A use-after-free in the replication component of MongoDB Server can occur when a newly ele...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
6.0.0 affects versions prior to 6.0.30
5.0.0 affects versions prior to 5.0.35
4.4.0 affects versions prior to 4.4.32
Reference Link →
11/10/2026
CVE-2026-120828
8.7
Memory exhaustion via abandoned far-future read-concern waiters in disaggregated storage
A replica-set database server node does not limit or reclaim internal wait records created...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
6.0.0 affects versions prior to 6.0.30
5.0.0 affects versions prior to 5.0.35
4.4.0 affects versions prior to 4.4.32
Reference Link →
11/10/2026
CVE-2026-120826
7.1
Improper Authorization in MongoDB Server Sharded View Definition Handling Leads to Cross-Database Unauthorized Access
An authorization flaw in the aggregation and view-definition handling of sharded deploymen...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
Reference Link →
11/10/2026
CVE-2026-120825
7.1
Improper Authorization in MongoDB Server Aggregation Framework View Definition Validation Leads to Unauthorized Collection Access
An authorization weakness in the aggregation framework of MongoDB Server may allow an auth...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
Reference Link →
11/10/2026
CVE-2026-120824
8.7
Post-authentication use-after-free in MongoDB Server time-series bucket validation
A use-after-free in the time-series collection component of MongoDB Server can occur when ...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
Reference Link →
11/10/2026
CVE-2026-120823
2.3
Missing Authorization Check in MongoDB Server Aggregation Framework Leads to Unauthorized Access to Deployment-Wide Configuration Data
A missing authorization check in the aggregation framework of MongoDB Server may allow a u...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
Reference Link →
11/10/2026
CVE-2026-120822
8.6
Missing Authorization Check in MongoDB Server Replication-Related Administrative Command Leads to Unauthorized Data Access
MongoDB Server may omit an authorization check on the resource that a replication-related ...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
Reference Link →
11/10/2026
CVE-2026-120821
7.1
Post-authentication use-after-free in MongoDB Server aggregation sub-pipelines
A use-after-free in the aggregation framework of MongoDB Server can occur when certain exp...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
Reference Link →
11/10/2026
CVE-2026-120820
5.3
Uncontrolled Resource Consumption in MongoDB Server Per-Namespace Encrypted-Field Statistics Table Leads to Denial of Service
MongoDB Server maintains an in-memory table of per-namespace statistics for operations tha...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
Reference Link →
11/10/2026
CVE-2026-120818
7.1
Use-After-Free in MongoDB Server JavaScript Support for Aggregation Leads to Information Disclosure
A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregati...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
Reference Link →
11/10/2026
CVE-2026-120817
7.1
Post-authentication race condition in MongoDB Server geospatial schema validation
A race condition in the schema validation component of MongoDB Server can occur when concu...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
Reference Link →
11/10/2026
CVE-2026-120816
2.3
System collection contents readable through a database change stream with showSystemEvents
A user with basic read-tier database privileges can use an option on a server-side data-ch...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
Reference Link →
11/10/2026
CVE-2026-120815
8.6
Incorrect Authorization Check in MongoDB Server Localhost Exception Leads to Unauthorized Administrative Access
An incorrect authorization check in the MongoDB Server authorization subsystem may allow a...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
Reference Link →
11/10/2026
CVE-2026-120814
7.5
MultiUpdateCoordinator state replay lets a shard administrator create a persistent cluster root user
An improper privilege management issue in the sharding subsystem of MongoDB Server may all...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
Reference Link →
11/10/2026
CVE-2026-120813
8.2
Plaintext storage of encrypted fields via duplicate keys in client-side encryption schema parsing
An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing ...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
Reference Link →
11/10/2026
CVE-2026-120812
6
Full server crash via unbounded per-operand recursion in time-series query vectorization
An issue in MongoDB Server's query processing component allows an authenticated user with ...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
Reference Link →
11/10/2026
CVE-2026-120811
6
Use-After-Free in MongoDB Server Classic Query Engine Plan Cache Leads to Information Disclosure and Denial of Service
A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Und...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
Reference Link →
11/10/2026
CVE-2026-120810
7.1
Uncontrolled Resource Consumption in MongoDB Server Aggregation Framework via Internal Expression Leads to Denial of Service
An issue in MongoDB server’s aggregation framework allows an authenticated user with read ...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
Reference Link →
11/10/2026
CVE-2026-120809
6.1
Heap use-after-free read via yield-time state save in time-series block unpacking
A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when pro...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
Reference Link →
11/10/2026
CVE-2026-120808
9.1
Certificate Validation Bypass via IPv6 trust-result skip in macOS TLS client
An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-tr...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
Reference Link →
11/10/2026
CVE-2026-120807
7.5
Privilege escalation via fail-open user lookup in X.509 cluster-membership guard
A flaw in MongoDB’s X.509 cluster-membership authentication guard could allow a holder of ...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
Reference Link →
11/10/2026
CVE-2026-120806
7
Authorization role-graph corruption via no-op cleanup filters in dropAllRolesFromDatabase
A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
Reference Link →
11/10/2026
CVE-2026-120805
2.3
Authorization bypass via redirected FLE2 state-collection writes in encrypted CRUD path
In MongoDB Server, an authenticated user with insert privileges on a collection could craf...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
Reference Link →
11/10/2026
CVE-2026-120804
8.2
Credential-handle retention via missing flag set in Windows Kerberos auth handler
A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterpris...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
8.0.0 affects versions prior to 8.0.37
7.0.0 affects versions prior to 7.0.48
Reference Link →
11/10/2026
CVE-2026-120803
7.1
MongoDB SBE $locf Window Accumulator Use-After-Free Enables Heap OOB Read and Server Crash
A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a ...
Affects:
MongoDB Server
Versions:
9.0.0 affects versions prior to 9.0.7
8.3.0 affects versions prior to 8.3.16
Reference Link →
11/03/2026
CVE-2026-120959
2.1
MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-array stride, causing out-of-bounds writes
A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for ...
Affects:
Atlas SQL
Versions:
1.3.0 affects versions prior to 3.0.1
Reference Link →
11/03/2026
CVE-2026-120952
6
MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds write
An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value ...
Affects:
Atlas SQL ODBC Driver
Versions:
0.0.1 affects versions prior to 3.0.1
Reference Link →
11/03/2026
CVE-2026-120567
2.3
ExecuteUpdate may evaluate caller-supplied values as MongoDB expressions
The MongoDB Entity Framework Core provider does not neutralize special elements when it pl...
Affects:
Entity Framework Core Provider
Versions:
9.1.3 affects 9.1.4 and prior versions
10.0.3 affects 10.0.4 and prior versions
Reference Link →
11/03/2026
CVE-2026-120953
5.1
Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler
A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Dr...
Affects:
Atlas SQL JDBC Driver
Versions:
2.1.2 affects versions prior to 4.0.1
Reference Link →
11/03/2026
CVE-2026-120954
6.3
Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views
A weakness in the BSON library's handling of a specialized binary vector data type allows ...
Affects:
C Driver
Versions:
2.0.0 affects 2.5.7 and prior versions
Reference Link →
11/03/2026
CVE-2026-120955
8.7
MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata
The GridFS file download API in the MongoDB C Driver does not check the result of an inter...
Affects:
C Driver
Versions:
1.25.0 affects 1.30.14 and prior versions
2.0.0 affects 2.5.7 and prior versions
Reference Link →
11/03/2026
CVE-2026-120956
7.1
remote abort and memory disclosure from a malformed cursor.ns
The MongoDB C Driver does not validate the type or format of a namespace field returned by...
Affects:
C Driver
Versions:
1.25.0 affects 1.30.14 and prior versions
2.0.0 affects 2.5.7 and prior versions
Reference Link →
11/03/2026
CVE-2026-120684
6
MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password
A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver ca...
Affects:
C Driver
Versions:
1.25.0 affects 1.30.14 and prior versions
2.0.0 affects 2.5.7 and prior versions
Reference Link →
11/03/2026
CVE-2026-120678
8.7
MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)
A memory management flaw in the MongoDB C Driver's handling of compressed responses may ca...
Affects:
C Driver
Versions:
1.25.0 affects 1.30.14 and prior versions
2.0.0 affects 2.5.7 and prior versions
Reference Link →
11/03/2026
CVE-2026-120673
6.8
Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command
A component of the MongoDB Rust Driver that records diagnostic tracing data can capture co...
Affects:
Rust Driver
Versions:
3.4.0 affects versions prior to 3.9.1
Reference Link →
11/03/2026
CVE-2026-119674
2.1
mongorestore may restore encoded collection names into an unintended collection
MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name re...
Affects:
Database Tools
Versions:
100.0.2 affects versions prior to 100.20.1
Reference Link →
11/03/2026
CVE-2026-119673
1
mongofiles may write outside the working directory through a symlink
MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when...
Affects:
Database Tools
Versions:
100.2.0 affects versions prior to 100.20.1
Reference Link →
11/03/2026
CVE-2026-119672
5.9
mongofiles may disclose GridFS content to standard output through a stored filename
MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output des...
Affects:
Database Tools
Versions:
3.1.4 affects versions prior to 100.20.1
Reference Link →
11/03/2026
CVE-2026-119675
5.2
mongorestore may bypass collection guards through a system.buckets prefix
MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when...
Affects:
Database Tools
Versions:
100.4.0 affects versions prior to 100.20.1
Reference Link →
11/03/2026
CVE-2026-119179
8.3
MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data
A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled...
Affects:
Node.js Driver
Versions:
6.11.0 affects versions prior to 6.22.0
7.0.0 affects versions prior to 7.8.0
Reference Link →
10/28/2026
CVE-2026-116641
7.6
The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs
The DB Tools rely on the TLS implementation in Golang’s standard library, which generally ...
Affects:
Database Tools
Versions:
affects versions prior to 100.20.0
Reference Link →
10/28/2026
CVE-2026-118581
6.9
NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol
A BSON encoding component of the MongoDB Java Driver does not verify that an externally su...
Affects:
Java Driver
Versions:
5.8.0 affects versions prior to 5.14.0
Reference Link →
10/28/2026
CVE-2026-118510
7.7
Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs
A type-handling flaw in the relationship query building of this MongoDB integration librar...
Affects:
Laravel MongoDB
Versions:
3.2.3 affects versions prior to 5.12.0
Reference Link →
10/26/2026
CVE-2026-115930
7.6
MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs
The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its ow...
Affects:
mongosh
Versions:
affects versions prior to 2.14.0
Reference Link →
10/24/2026
CVE-2026-115929
7.6
MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root ce...
Affects:
Compass
Versions:
affects versions prior to 1.53.1
Reference Link →
10/22/2026
CVE-2026-114655
6
KMS request injection via unsanitized key vault and provider values in libmongocrypt
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by ...
Affects:
libmongocrypt
Versions:
1.0.0 affects versions prior to 1.21.1
Reference Link →
10/22/2026
CVE-2026-114654
6.9
BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allow...
Affects:
C# Driver
Versions:
2.0.0 affects versions prior to 3.13.0
Reference Link →
10/22/2026
CVE-2026-114653
7.1
Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
A client-side encryption schema construction component in the MongoDB C# Driver places cal...
Affects:
C# Driver
Versions:
3.5.0 affects versions prior to 3.13.0
Reference Link →
10/22/2026
CVE-2026-114652
7.1
Update operator injection via single-element list rewriting in the update builder
A data-query-logic neutralization weakness in the update-statement construction component ...
Affects:
C# Driver
Versions:
2.0.0 affects versions prior to 3.13.0
Reference Link →
10/22/2026
CVE-2026-114651
6.3
Cross-document data leak via malformed BSON array parsing in reused thread buffer
A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver ...
Affects:
C# Driver
Versions:
2.26.0 affects versions prior to 3.13.0
Reference Link →
10/22/2026
CVE-2026-114650
6.9
Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data ...
Affects:
C# Driver
Versions:
2.10.0 affects versions prior to 3.13.0
Affects:
MongoDB.Libmongocrypt NuGet package
Versions:
1.0.0 affects 1.12.0 and prior versions
Reference Link →
10/22/2026
CVE-2026-114649
7.6
Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only wh...
Affects:
C# Driver
Versions:
1.8.0 affects versions prior to 3.13.0
Reference Link →
10/22/2026
CVE-2026-114648
7.2
NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, fi...
Affects:
C# Driver
Versions:
2.14.0 affects versions prior to 3.13.0
Reference Link →
10/22/2026
CVE-2026-114647
5.3
NoSQL operator injection via unvalidated replacement document in findOneAndReplace
The MongoDB C# Driver does not reject replacement documents whose top-level field names be...
Affects:
C# Driver
Versions:
2.13.0 affects versions prior to 3.13.0
Reference Link →
10/22/2026
CVE-2026-114646
6.9
NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
A data-validation flaw exists in the BSON handling and binary serialization path of the Mo...
Affects:
C# Driver
Versions:
2.0.0 affects versions prior to 3.13.0
Reference Link →
10/22/2026
CVE-2026-114645
5.7
Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentic...
Affects:
C Driver
Versions:
1.6.0 affects versions prior to 1.30.14
2.0.0 affects versions prior to 2.5.7
Reference Link →
10/22/2026
CVE-2026-114644
8.2
Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weaknes...
Affects:
C# Driver
Versions:
2.0.0 affects versions prior to 3.13.0
Reference Link →
10/22/2026
CVE-2026-114643
5.3
Duplicate geometry fields via unvalidated GeoJSON extra members
The MongoDB C# Driver writes GeoJSON extra members without checking whether their names co...
Affects:
C# Driver
Versions:
1.8.0 affects versions prior to 3.13.0
Reference Link →
10/21/2026
CVE-2026-113870
8.8
Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s agg...
Affects:
Compass
Versions:
1.7.0 affects versions prior to 1.49.15
Reference Link →
10/19/2026
CVE-2026-112368
8.2
Unbounded Recursion in phongo_bson_visit_document/visit_array:
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver ma...
Affects:
PHP Driver
Versions:
1.0.0 affects versions prior to 1.21.12
2.1.0 affects versions prior to 2.1.12
2.5.0 affects versions prior to 2.5.5
Reference Link →
10/13/2026
CVE-2026-104005
7.1
Incorrect authorization in MongoDB Server router for bulk writes to system namespaces
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an au...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.13
9.0 affects versions prior to 9.0.4
Reference Link →
10/13/2026
CVE-2026-104004
7.1
Collection validators using collation-accepting expressions can crash MongoDB Server on insert
MongoDB Server's collection validation feature may not properly handle certain expressions...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.13
8.0 affects versions prior to 8.0.34
9.0 affects versions prior to 9.0.4
Reference Link →
10/13/2026
CVE-2026-103965
5.3
Fixed values in MongoDB Server $bucket stage may be misread as field references
An issue in MongoDB Server's aggregation framework can cause certain constant values to be...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.13
8.0 affects versions prior to 8.0.34
7.0 affects versions prior to 7.0.45
9.0 affects versions prior to 9.0.4
Reference Link →
10/13/2026
CVE-2026-96299
7.1
Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service
A security issue was discovered in MongoDB mongos (the sharded cluster router) where an au...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.13
9.0 affects versions prior to 9.0.4
Reference Link →
10/13/2026
CVE-2026-96297
6
MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline
Use of freed memory in the aggregation feature of MongoDB Server can cause the server to r...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.13
8.0 affects versions prior to 8.0.34
7.0 affects versions prior to 7.0.45
9.0 affects versions prior to 9.0.2
Reference Link →
10/09/2026
CVE-2026-87109
6
Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings
An authenticated Ops Manager organization member can retrieve another member's pending aut...
Affects:
Ops Manager
Versions:
7.0.0 affects 7.0.23 and prior versions
8.0.0 affects versions prior to 8.0.27
Reference Link →
10/09/2026
CVE-2026-87108
2.3
Ops Manager Improper Authorization in Daily Host Monitoring Retrieval
An authenticated Ops Manager user with a read-only project role can retrieve a daily host ...
Affects:
Ops Manager
Versions:
7.0.0 affects 7.0.23 and prior versions
8.0.0 affects versions prior to 8.0.27
Reference Link →
10/09/2026
CVE-2026-87110
6.9
Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints
An unauthenticated user with network access to the Ops Manager web port can repeatedly req...
Affects:
Ops Manager
Versions:
7.0.0 affects 7.0.23 and prior versions
8.0.0 affects versions prior to 8.0.27
Reference Link →
10/08/2026
CVE-2026-106435
5.9
Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver
The MongoDB Python Driver's binary accelerator can read outside a buffer when an applicati...
Affects:
Python Driver
Versions:
0.10.3 affects 4.18.2 and prior versions
Reference Link →
10/08/2026
CVE-2026-106436
6.3
Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver
The BSON encoder in the MongoDB PHP Driver does not check some return values after a docum...
Affects:
PHP Driver
Versions:
1.3.0 affects versions prior to 1.21.11
2.0.0 affects versions prior to 2.1.11
2.2.0 affects versions prior to 2.5.4
Reference Link →
10/08/2026
CVE-2026-106432
2
Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver
The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value with...
Affects:
PHP Driver
Versions:
1.16.0 affects versions prior to 1.21.11
2.0.0 affects versions prior to 2.1.11
2.2.0 affects versions prior to 2.5.4
Reference Link →
10/08/2026
CVE-2026-107325
8.2
Application denial of service via missing BSON array length validation in MongoDB Go Driver
Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bo...
Affects:
Go Driver
Versions:
1.1.0 affects 1.17.10 and prior versions
2.0.0 affects versions prior to 2.9.2
Reference Link →
10/08/2026
CVE-2026-107324
8.2
Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver
An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a run...
Affects:
Go Driver
Versions:
1.0.0 affects versions prior to 1.2.0
2.0.0 affects versions prior to 2.9.0
Reference Link →
10/08/2026
CVE-2026-106434
5.3
Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt
The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encr...
Affects:
libmongocrypt
Versions:
1.5.0 affects versions prior to 1.20.5
Reference Link →
10/08/2026
CVE-2026-106433
8.7
Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt
Improper state management in MongoDB libmongocrypt can cause provider-specific data to be ...
Affects:
libmongocrypt
Versions:
1.1.0 affects versions prior to 1.20.5
Reference Link →
10/08/2026
CVE-2026-106429
7.1
Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt
An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause ...
Affects:
libmongocrypt
Versions:
1.1.0 affects versions prior to 1.20.5
Reference Link →
10/08/2026
CVE-2026-106430
6
Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver
The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and co...
Affects:
C++ Driver
Versions:
3.0.0 affects versions prior to 4.6.1
Reference Link →
10/08/2026
CVE-2026-106438
5.1
Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept c...
Affects:
C Driver
Versions:
1.4.0 affects versions prior to 1.30.13
2.0.0 affects versions prior to 2.5.6
Reference Link →
10/08/2026
CVE-2026-106437
5.9
Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than t...
Affects:
C Driver
Versions:
1.4.0 affects versions prior to 1.30.13
2.0.0 affects versions prior to 2.5.6
Reference Link →
10/08/2026
CVE-2026-106431
5.9
One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one...
Affects:
C Driver
Versions:
0.5.0 affects versions prior to 1.30.13
2.0.0 affects versions prior to 2.5.6
Reference Link →
10/08/2026
CVE-2026-106428
6.3
Out-of-bounds read in SCRAM response parsing in MongoDB C Driver
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can...
Affects:
C Driver
Versions:
1.1.0 affects versions prior to 1.30.13
2.0.0 affects versions prior to 2.4.0
Reference Link →
10/05/2026
CVE-2026-103546
2.3
Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator
In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup confi...
Affects:
Mongodb Controllers for Kubernetes
Versions:
affects versions prior to 1.13.0
Reference Link →
09/24/2026
CVE-2026-96749
7.5
Heap out-of-bounds write via signed size overflow in BSON document encoding
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's...
Affects:
Python Driver
Versions:
1.9.0 affects versions prior to 4.18.2
Reference Link →
09/24/2026
CVE-2026-96748
8.3
Connection redirection via percent-encoded delimiter injection in connection string hosts
PyMongo's connection string parsing decodes percent-encoded characters in the host portion...
Affects:
Python Driver
Versions:
affects versions prior to 4.18.2
Reference Link →
09/24/2026
CVE-2026-96747
5.3
Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption
The client-side field level encryption support in the MongoDB Python Driver can treat a ke...
Affects:
Python Driver
Versions:
3.9.0 affects versions prior to 4.18.2
Reference Link →
09/24/2026
CVE-2026-96745
6.3
PHP object injection via unsuppressible __pclass class inference in command monitoring events
Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Dri...
Affects:
PHP Driver
Versions:
affects versions prior to 1.21.10
2.0.0 affects versions prior to 2.1.10
2.2.0 affects versions prior to 2.5.3
Reference Link →
09/24/2026
CVE-2026-96746
8.3
Heap buffer overflow via mid-scan command list growth in client topology monitoring
An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allo...
Affects:
C Driver
Versions:
affects versions prior to 1.30.12
2.0.0 affects versions prior to 2.5.5
Reference Link →
09/24/2026
CVE-2026-96750
7.3
Shell script injection via server-supplied database name in Open MongoDB shell
MongoDB Compass can interpolate a database name without escaping into the initial input of...
Affects:
Compass
Versions:
1.44.0 affects versions prior to 1.49.12
Reference Link →
09/24/2026
CVE-2026-96744
7.1
Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel
Improper neutralization of special elements in data query logic in the cache lock implemen...
Affects:
Laravel MongoDB (PHP)
Versions:
4.3.0 affects versions prior to 5.11.0
Reference Link →
09/18/2026
CVE-2026-93759
8.8
Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist
Mongoid does not neutralize a string-typed query criterion supplied to its query builder, ...
Affects:
Mongoid
Versions:
9.1.0
9.0.0 affects 9.0.11 and prior versions
8.1.0 affects 8.1.12 and prior versions
8.0.0 affects 8.0.12 and prior versions
Reference Link →
09/18/2026
CVE-2026-93760
8.3
NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard
Mongoid does not restrict which query operators may come from caller-supplied filter data ...
Affects:
Mongoid
Versions:
9.1.0
9.0.0 affects 9.0.11 and prior versions
8.1.0 affects 8.1.12 and prior versions
8.0.0 affects 8.0.12 and prior versions
Reference Link →
09/18/2026
CVE-2026-93761
8.7
Denial of service via unbounded regex matching in Mongoid's in-memory query matcher
An inefficient regular expression complexity issue in the in-memory query evaluation compo...
Affects:
Mongoid
Versions:
7.2.0 affects 7.2.6 and prior versions
7.3.0 affects 7.3.5 and prior versions
7.4.0 affects 7.4.3 and prior versions
7.5.0 affects 7.5.4 and prior versions
7.6.0 affects 7.6.1 and prior versions
8.0.0 affects 8.0.12 and prior versions
8.1.0 affects 8.1.12 and prior versions
9.0.0 affects 9.0.11 and prior versions
9.1.0
Reference Link →
09/18/2026
CVE-2026-93762
9.2
Data deletion and attribute disclosure via field-name method injection in in-memory queries
Mongoid contains an unsafe reflection weakness in the query path used for embedded documen...
Affects:
Mongoid
Versions:
9.1.0
9.0.0 affects 9.0.11 and prior versions
8.1.0 affects 8.1.12 and prior versions
8.0.0 affects 8.0.12 and prior versions
7.6.0 affects 7.6.1 and prior versions
7.5.0 affects 7.5.4 and prior versions
Reference Link →
09/18/2026
CVE-2026-93763
7.1
Silent plaintext persistence via unresolved callable database name in encryption schema map
A protection mechanism failure in the object-document mapper's encryption configuration ge...
Affects:
Mongoid
Versions:
9.1.0
9.0.0 affects 9.0.11 and prior versions
Reference Link →
09/18/2026
CVE-2026-93764
7.1
Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation
Mongoid may omit encryption rules for fields declared on embedded models when generating t...
Affects:
Mongoid
Versions:
9.1.0
9.0.0 affects 9.0.11 and prior versions
Reference Link →
09/18/2026
CVE-2026-93765
8.3
Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation
Mongoid contains an unsafe reflection weakness in the document persistence layer of its ob...
Affects:
Mongoid
Versions:
9.1.0
9.0.0 affects 9.0.11 and prior versions
8.1.0 affects 8.1.12 and prior versions
8.0.0 affects 8.0.12 and prior versions
Reference Link →
09/18/2026
CVE-2026-93758
8.6
Cross-principal document update, theft, and deletion via unvalidated id in nested attributes
An insecure direct object reference in the nested attributes handling of the Mongoid objec...
Affects:
Mongoid
Versions:
9.1.0
9.0.0 affects 9.0.11 and prior versions
8.1.0 affects 8.1.12 and prior versions
8.0.0 affects 8.0.12 and prior versions
Reference Link →
09/17/2026
CVE-2026-93395
6.9
Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()
A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows ...
Affects:
C Driver
Versions:
2.0.0 affects versions prior to 2.3.1
Reference Link →
09/17/2026
CVE-2026-93394
6.3
libmongoc SCRAM client nonce-validation bypass
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue th...
Affects:
C Driver
Versions:
2.0.0 affects versions prior to 2.3.2
Reference Link →
09/17/2026
CVE-2026-93393
9.2
Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream
A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver whe...
Affects:
C Driver
Versions:
2.4.0
2.3.0 affects 2.3.3 and prior versions
2.2.0 affects 2.2.4 and prior versions
2.1.0 affects 2.1.2 and prior versions
2.0.0 affects 2.0.2 and prior versions
1.30.0 affects 1.30.8 and prior versions
1.29.0 affects 1.29.2 and prior versions
1.28.0 affects 1.28.1 and prior versions
1.27.0 affects 1.27.6 and prior versions
1.26.0 affects 1.26.2 and prior versions
1.25.0 affects 1.25.4 and prior versions
1.24.0 affects 1.24.4 and prior versions
Reference Link →
09/17/2026
CVE-2026-92757
6.8
Malformed connection string may disable field level encryption
Applications built on MongoDB Entity Framework Core Provider which place a database name i...
Affects:
MongoDB Entity Framework Core Provider
Versions:
8.3.1 affects versions prior to 8.4.4
9.0.1 affects versions prior to 9.1.4
10.0.0 affects versions prior to 10.0.4
Reference Link →
09/17/2026
CVE-2026-92758
5.7
Logs may collect sensitive information
If logging mode is set to DEBUG or a malformed MongoDB connection string is used, applicat...
Affects:
MongoDB Entity Framework Core Provider
Versions:
8.0.0 affects versions prior to 8.4.4
9.0.0 affects versions prior to 9.1.4
10.0.0 affects versions prior to 10.0.4
Reference Link →
09/17/2026
CVE-2026-92756
6.8
Combining encryption settings may disable encryption
Applications built on MongoDB Entity Framework Core Provider which combine independent enc...
Affects:
MongoDB Entity Framework Core Provider
Versions:
8.0.0 affects versions prior to 8.4.3
9.0.0 affects versions prior to 9.1.3
10.0.0 affects versions prior to 10.0.3
Reference Link →
09/11/2026
CVE-2026-89099
7.7
Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption
A race condition in the document value layer of MongoDB Server can allow concurrent server...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.11
8.0 affects versions prior to 8.0.32
7.0 affects versions prior to 7.0.43
Reference Link →
09/10/2026
CVE-2026-88036
6.1
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver
Improper neutralization of special elements in data query logic in the GridFS component of...
Affects:
C Driver
Versions:
1.14.0 affects versions prior to 1.30.10
2.0.0 affects versions prior to 2.5.3
Reference Link →
09/10/2026
CVE-2026-88035
5.7
Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver
A size check in the client-side authentication path of the MongoDB C Driver can wrap aroun...
Affects:
C Driver
Versions:
2.2.0 affects versions prior to 2.5.3
Reference Link →
09/10/2026
CVE-2026-88034
6.1
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver
Improper neutralization of special elements in data query logic in the GridFS component of...
Affects:
C++ Driver
Versions:
3.2.0 affects versions prior to 4.5.3
Reference Link →
09/10/2026
CVE-2026-88033
6.1
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver
Improper neutralization of special elements in data query logic in the GridFS component of...
Affects:
Java Driver
Versions:
3.3.0 affects versions prior to 5.11.1
Reference Link →
09/10/2026
CVE-2026-88032
8.2
Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver
A use-after-free in the reactive client-side encryption component of the MongoDB Java Driv...
Affects:
Java Driver
Versions:
4.2.0 affects versions prior to 5.11.1
Affects:
org.mongodb:mongodb-crypt Maven package
Versions:
1.4.0 affects versions prior to 5.11.1
Affects:
org.mongodb:mongodb-driver-reactivestreams Maven package
Versions:
4.6.0 affects versions prior to 5.11.1
Reference Link →
09/10/2026
CVE-2026-88031
6.1
GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver
Improper neutralization of special elements in data query logic in the GridFS component of...
Affects:
Go Driver
Versions:
1.0.0 affects versions prior to 1.17.10
2.0.0 affects versions prior to 2.9.1
Reference Link →
09/10/2026
CVE-2026-88030
6.1
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver
Improper neutralization of special elements in data query logic in the GridFS component of...
Affects:
Ruby Driver
Versions:
2.0.0 affects 2.25.0 and prior versions
Reference Link →
09/10/2026
CVE-2026-88029
6.1
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver
Improper neutralization of special elements in data query logic in the GridFS component of...
Affects:
Python Driver
Versions:
1.6.0 affects versions prior to 4.18.1
Reference Link →
09/10/2026
CVE-2026-88028
7.1
Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel
Improper neutralization of special elements in data query logic in the polymorphic relatio...
Affects:
Laravel MongoDB (PHP)
Versions:
1.2.0 affects versions prior to 5.11.0
Reference Link →
09/10/2026
CVE-2026-88027
7.1
Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel
Improper neutralization of special elements in data query logic in the embedded-document r...
Affects:
Laravel MongoDB (PHP)
Versions:
4.0.0 affects versions prior to 5.11.0
Reference Link →
09/10/2026
CVE-2026-88026
7.1
Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver
Improper neutralization of regular-expression metacharacters in the LINQ query translation...
Affects:
C# Driver
Versions:
2.14.0 affects 3.11.1 and prior versions
Reference Link →
09/10/2026
CVE-2026-88025
6.1
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver
Improper neutralization of special elements in data query logic in the GridFS component of...
Affects:
C# Driver
Versions:
2.3.0 affects 3.11.1 and prior versions
Reference Link →
09/10/2026
CVE-2026-88024
6.1
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver
Improper neutralization of special elements in data query logic in the GridFS component of...
Affects:
Rust Driver
Versions:
2.4.0 affects versions prior to 3.9.1
Reference Link →
09/10/2026
CVE-2026-88023
6.1
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library
Improper neutralization of special elements in data query logic in the GridFS component of...
Affects:
MongoDB PHP Library
Versions:
1.1.0 affects 1.21.4 and prior versions
2.0.0 affects 2.4.1 and prior versions
Reference Link →
09/10/2026
CVE-2026-88022
8.4
Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel
Improper neutralization of special elements in data query logic in the MongoDB integration...
Affects:
Laravel MongoDB (PHP)
Versions:
1.0.0 affects versions prior to 5.11.0
Reference Link →
09/08/2026
CVE-2026-82076
7.1
Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server
An integer overflow in the query planning component of MongoDB Server can allow an authent...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82075
8.7
Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service
An uncontrolled resource consumption weakness exists in the request-handling path of the M...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82074
7.1
Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data
MongoDB Server contains an incorrect authorization vulnerability in the aggregation framew...
Affects:
MongoDB Server
Versions:
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82073
7.1
Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search
A security issue in the MongoDB Server aggregation framework allows an authenticated user ...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
Reference Link →
09/08/2026
CVE-2026-82071
7.2
Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write
Insufficient validation of storage engine configuration options in MongoDB Server allows a...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
Reference Link →
09/08/2026
CVE-2026-82070
7.1
Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface
A security issue in MongoDB Server's diagnostic reporting interface allows an authenticate...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82069
5.1
Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router
A security issue in MongoDB Server's query statistics serialization on the router allows u...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
Reference Link →
09/08/2026
CVE-2026-82068
7.1
Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service
A security issue in MongoDB Server allows an authenticated user with write privileges to t...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82067
9.2
Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup
Improper handling of case sensitivity in the configuration validation component of MongoDB...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82066
5.3
Heap Out-of-Bounds Read in MongoDB Server Query Planning Component
A heap out-of-bounds read security issue exists in the query planning component of MongoDB...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82065
7.1
Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata
A security issue in the MongoDB Server's storage engine integration layer allows an authen...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82064
8.7
Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members
A security issue in MongoDB Server allows an unauthenticated network user to cause a denia...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82063
6
Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service
A use-after-free security issue in the cursor management component of MongoDB Server allow...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82062
7
Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass
A security issue in MongoDB Server allows an authenticated user with elevated internal pri...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
Reference Link →
09/08/2026
CVE-2026-82061
7.2
Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service
A use-after-free security issue exists in the server's query execution memory tracking sub...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
Reference Link →
09/08/2026
CVE-2026-82060
2.3
Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups
In MongoDB, insufficient validation of shard key values during document insertion allowed ...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82059
6
Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service
An internal aggregation expression in MongoDB Server was incorrectly registered as accessi...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82058
7.1
Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service
A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated u...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82057
7.1
Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service
A security issue was discovered in MongoDB where an authenticated user with readWrite priv...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
Reference Link →
09/08/2026
CVE-2026-82056
6
Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service
A race condition in MongoDB server's text index query parsing can cause a heap use-after-f...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82055
7.1
Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service
A security issue exists in MongoDB's 2dsphere index key generation that can cause a server...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
Reference Link →
09/08/2026
CVE-2026-82054
7.1
Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service
A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema qu...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82053
7.6
Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment
A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP conn...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0.0 affects versions prior to 8.0.30
7.0.0 affects versions prior to 7.0.41
Reference Link →
09/08/2026
CVE-2026-82052
7.1
$regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars
The $regexFindAll expression can be used by an authenticated user who can run aggregation ...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.9
8.0 affects versions prior to 8.0.30
7.0 affects versions prior to 7.0.41
Reference Link →
09/03/2026
CVE-2026-84968
6.9
Heap out-of-bounds read via corrupt nested BSON in field path error message
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow a...
Affects:
PHP Driver
Versions:
1.15.0 affects versions prior to 1.21.8
2.0.0 affects versions prior to 2.5.1
Reference Link →
09/03/2026
CVE-2026-84967
5.1
Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal
A component of the MongoDB extension for Visual Studio Code does not neutralize special ch...
Affects:
MongoDB for VS Code
Versions:
1.13.0 affects versions prior to 1.17.1
Reference Link →
09/03/2026
CVE-2026-84962
5.7
Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
An unauthorized user with key vault write access may cause an authorized client to issue a...
Affects:
libmongocrypt
Versions:
affects versions prior to 1.20.2
Reference Link →
09/03/2026
CVE-2026-84963
6.3
Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser
An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BS...
Affects:
C Driver
Versions:
1.10.0 affects versions prior to 1.30.9
2.0.0 affects versions prior to 2.5.2
Reference Link →
09/03/2026
CVE-2026-84964
8.2
Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client
A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB...
Affects:
C Driver
Versions:
1.17.0 affects versions prior to 1.30.9
2.0.0 affects versions prior to 2.5.2
Reference Link →
09/03/2026
CVE-2026-84965
5.9
Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds
An integer wraparound in an allocation size calculation in the BSON library's JSON parsing...
Affects:
C Driver
Versions:
1.10.0 affects versions prior to 1.30.9
2.0.0 affects versions prior to 2.5.2
Reference Link →
09/03/2026
CVE-2026-84966
5.9
BSON element injection via NUL-embedded document keys in builder append
An incorrect numeric type conversion in the BSON document building component of the MongoD...
Affects:
C++ Driver
Versions:
3.2.0 affects versions prior to 4.5.2
Reference Link →
09/03/2026
CVE-2026-84969
6.3
Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output
A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can...
Affects:
C Driver
Versions:
1.30.0 affects versions prior to 1.30.9
2.0.0 affects versions prior to 2.5.2
Reference Link →
09/03/2026
CVE-2026-84971
7.1
Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path
Improper handling of an unexpected value size in the decryption path of a client-side encr...
Affects:
libmongocrypt
Versions:
1.7.0 affects versions prior to 1.20.4
Reference Link →
09/03/2026
CVE-2026-84970
5.9
Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser
A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driv...
Affects:
C++ Driver
Versions:
3.2.0 affects versions prior to 4.5.2
Reference Link →
08/28/2026
CVE-2026-81533
6
MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values
An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety is...
Affects:
BI Connector ODBC Driver
Versions:
affects versions prior to 1.4.10
Reference Link →
08/28/2026
CVE-2026-81532
8.7
BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption
A user able to submit SQL through an application using the MongoDB Connector for BI ODBC d...
Affects:
BI Connector ODBC Driver
Versions:
affects versions prior to 1.4.10
Reference Link →
08/28/2026
CVE-2026-81520
8.7
MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for...
Affects:
BI Connector
Versions:
affects versions prior to 2.14.31
Reference Link →
08/28/2026
CVE-2026-81518
8.7
BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections
When mongosqld is configured with a client certificate authority file, the listener reques...
Affects:
BI Connector
Versions:
affects versions prior to 2.14.31
Reference Link →
08/28/2026
CVE-2026-81517
8.7
MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service
An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) ...
Affects:
BI Connector
Versions:
affects versions prior to 2.14.31
Reference Link →
08/28/2026
CVE-2026-81490
8.3
MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service
A database user able to create a view in a namespace that MongoDB Connector for BI samples...
Affects:
BI Connector
Versions:
affects versions prior to 2.14.31
Reference Link →
08/28/2026
CVE-2026-77586
8.5
MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output
In MongoDB Connector for BI, MongoDB object names such as collection, field, and index nam...
Affects:
BI Connector
Versions:
2.1.0 affects versions prior to 2.14.31
Reference Link →
08/28/2026
CVE-2026-77184
5.6
MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output
In MongoDB Connector for BI, the description text of a collection's JSON schema validator ...
Affects:
BI Connector
Versions:
2.1.0 affects versions prior to 2.14.31
Reference Link →
08/28/2026
CVE-2026-76798
6.9
MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports
The MongoSQL Transition Readiness Tool writes query text and user names read from BI Conne...
Affects:
BI Connector Transition Readiness Report
Versions:
1.0.0 affects versions prior to 1.1.3
Reference Link →
08/28/2026
CVE-2026-76797
5.8
MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports
The MongoSQL Transition Readiness Tool writes database and collection names into its gener...
Affects:
BI Connector Transition Readiness Report
Versions:
1.0.0 affects versions prior to 1.1.3
Reference Link →
08/28/2026
CVE-2026-76794
4.8
MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata
MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before i...
Affects:
BI Connector Transition Readiness Report
Versions:
1.0.0 affects versions prior to 1.1.3
Reference Link →
08/27/2026
CVE-2026-81530
6.8
KMS master key exposure via unredacted credential serialization in driver settings string
A weakness in the client-side encryption configuration surface of the MongoDB C# Driver ca...
Affects:
C# Driver
Versions:
2.10.0 affects versions prior to 3.11.1
Reference Link →
08/27/2026
CVE-2026-81529
7.1
Connection-option injection via unescaped settings in the canonical MongoDB URL builder
Improper neutralization of delimiters in connection-URL construction allows connection-opt...
Affects:
C# Driver
Versions:
3.5.0 affects versions prior to 3.11.1
Reference Link →
08/27/2026
CVE-2026-81528
5.3
NoSQL injection via array replacement bypassing update shape validation in driver write path
A MongoDB C# driver document-replacement code path omits the element-name/shape validation...
Affects:
C# Driver
Versions:
2.9.0 affects versions prior to 3.11.1
Reference Link →
08/27/2026
CVE-2026-81527
6.9
NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation
A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation ...
Affects:
C# Driver
Versions:
2.14.0 affects versions prior to 3.11.1
Reference Link →
08/27/2026
CVE-2026-81526
7.1
Cross-database write redirection via unvalidated dotted database name in bulk write namespaces
The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target...
Affects:
Rust Driver
Versions:
3.0.0 affects versions prior to 3.8.2
Reference Link →
08/27/2026
CVE-2026-81525
8.6
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
The MongoDB client library for PHP does not sufficiently sanitize special elements in appl...
Affects:
PHP Library
Versions:
affects versions prior to 1.21.4
2.0.0 affects versions prior to 2.4.1
Affects:
PHP Extension
Versions:
affects versions prior to 1.21.6
2.0.0 affects versions prior to 2.4.1
Reference Link →
08/27/2026
CVE-2026-81524
5.3
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and...
Affects:
C Driver
Versions:
1.0.0 affects versions prior to 2.5.1
Reference Link →
08/27/2026
CVE-2026-81523
2
Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context s...
Affects:
libmongocrypt
Versions:
1.0.0 affects versions prior to 1.20.3
Reference Link →
08/27/2026
CVE-2026-81522
8.6
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers a...
Affects:
C++ Driver
Versions:
3.0.0 affects versions prior to 4.5.1
Reference Link →
08/27/2026
CVE-2026-81521
7.1
Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied dat...
Affects:
GO Driver
Versions:
2.1.0 affects versions prior to 2.8.2
Reference Link →
08/27/2026
CVE-2026-75573
4.1
MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied
In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard er...
Affects:
BI Connector
Versions:
2.12.0 affects versions prior to 2.14.30
Reference Link →
08/27/2026
CVE-2026-75159
8.2
MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination
An unauthenticated client that can reach a MongoDB Connector for BI deployment configured ...
Affects:
BI Connector
Versions:
2.4.0 affects versions prior to 2.14.30
Reference Link →
08/12/2026
CVE-2026-19003
8.4
MongoDB BI Connector ODBC driver may write outside an allocated buffer when the setup dialog opens a data source with oversized path settings
A data source definition containing an over-length file path setting may cause the MongoDB...
Affects:
BI Connector ODBC Driver
Versions:
1.0.0 affects versions prior to 1.4.9
Reference Link →
08/12/2026
CVE-2026-19004
8.8
MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters
An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety i...
Affects:
BI Connector ODBC Driver
Versions:
1.0.0 affects versions prior to 1.4.9
Reference Link →
08/12/2026
CVE-2026-18888
7.1
MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character data
The MongoDB BI Connector ODBC Driver converts floating point column values into text witho...
Affects:
BI Connector ODBC Driver
Versions:
1.0.0 affects versions prior to 1.4.9
Reference Link →
08/12/2026
CVE-2026-19001
9.5
MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names
The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer w...
Affects:
BI Connector ODBC Driver
Versions:
1.0.0 affects versions prior to 1.4.9
Reference Link →
08/12/2026
CVE-2026-19002
8.8
Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver
A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI ...
Affects:
BI Connector ODBC Driver
Versions:
1.0.0 affects versions prior to 1.4.9
Reference Link →
08/12/2026
CVE-2026-19503
6.3
Insufficient OIDC endpoint validation could invoke unintended local protocol handlers
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the...
Affects:
Atlas SQL ODBC Driver
Versions:
1.0.0 affects versions prior to 2.0.9
Affects:
Schema Builder CLI
Versions:
1.0.1 affects versions prior to 1.2.1
Reference Link →
08/12/2026
CVE-2026-19502
6.8
Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, w...
Affects:
Schema Builder CLI
Versions:
1.0.0 affects versions prior to 1.2.1
Reference Link →
08/11/2026
CVE-2026-18710
8.2
Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization
A MongoDB driver component could write sensitive configuration information, including a cr...
Affects:
MongoDB Driver
Versions:
4.11.0 affects versions prior to 5.9.2
Reference Link →
08/11/2026
CVE-2026-18712
7.2
Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an au...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18711
7.1
Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure
An issue in MongoDB Server's query execution engine could allow an authenticated user with...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
Reference Link →
08/11/2026
CVE-2026-18709
5.9
Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency
An issue in MongoDB Server could allow an authenticated user with direct network access to...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18698
5.3
Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command
An issue in MongoDB Server could allow an authenticated user with a limited database-scope...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18690
7.2
Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections
An issue in MongoDB Server could allow an authenticated user with a limited database-scope...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18699
6
Improper Input Validation in MongoDB Query Planner Leads to Denial of Service
An issue in MongoDB Server's query planner could allow an authenticated user with read-lev...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18691
9
Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure
An issue in MongoDB Server's intra-cluster connection setup could allow a party with suita...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18702
5.3
Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18694
7.1
Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure
An issue in MongoDB Server's geospatial query processing could allow an authenticated user...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18708
5.3
Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes
An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18696
7
Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections
An issue in MongoDB Server's applyOps command could allow an authenticated user with speci...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18700
6
Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service
An issue in MongoDB Server's geospatial validation could allow an authenticated user with ...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18701
7.1
Type Confusion in MongoDB Query Subsystem Leads to Denial of Service
An issue in MongoDB Server's query subsystem could allow an authenticated user with read p...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18697
8.7
Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos
An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18693
7.2
Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure
An issue in MongoDB Server's handling of timeseries collections could allow an authenticat...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18705
7.1
Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data
An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18704
7.1
Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations
An issue in MongoDB Server's aggregation framework could allow an authenticated user with ...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
Reference Link →
08/11/2026
CVE-2026-18692
7.7
Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution
An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authen...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
Reference Link →
08/11/2026
CVE-2026-18688
7.1
Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure
An issue in MongoDB Server's aggregation framework could allow an authenticated user to tr...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18695
7.1
Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service
An issue in MongoDB Server's handling of certain query predicates against time-series coll...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
7.0 affects versions prior to 7.0.40
Reference Link →
08/11/2026
CVE-2026-18687
7.1
Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption
MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
8.0 affects versions prior to 8.0.29
Reference Link →
08/11/2026
CVE-2026-18706
7.5
Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution
An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated u...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
Reference Link →
08/11/2026
CVE-2026-18707
5.3
Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service
An issue in MongoDB Server could allow an authenticated user, including one with no assign...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
Reference Link →
08/11/2026
CVE-2026-18703
2.3
Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method
An issue in MongoDB Server could allow a party with a valid client certificate and a corre...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.8
Reference Link →
07/22/2026
CVE-2026-14881
8.4
Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow
When importing connections in Compass it is possible to override some connection options t...
Affects:
MongoDB Compass
Versions:
1.38.0 affects versions prior to 1.49.7
Reference Link →
07/22/2026
CVE-2026-13055
7.1
Server crash via aggregation pipeline expression with compound wildcard index specification
The `$_internalIndexKey` aggregation expression can be used by any authenticated user to c...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13056
7.1
A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM
Using expressions that generate large arrays it is possible to craft a query that creates ...
Affects:
MongoDB Server
Versions:
8.0 affects versions prior to 8.0.28
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13057
6
Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META
An issue in the server’s Atlas Search integration allows an authenticated user to bypass p...
Affects:
MongoDB Server
Versions:
8.0 affects versions prior to 8.0.28
8.3.0 affects versions prior to 8.3.7
8.2.0 affects versions prior to 8.2.12
Reference Link →
07/22/2026
CVE-2026-13058
7.1
Transaction Command Insufficient Input Validation Leading to Process Termination
An authenticated user with basic write privileges can cause the mongod process to terminat...
Affects:
MongoDB Server
Versions:
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13059
8.6
Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass
An authenticated user with low privileges may be able to perform unauthorized reads and wr...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-9737
7.1
Find command with $meta sort can lead to crash
During query planning when reading the sort pattern in raw BSONObj form, in some places we...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13060
7.1
$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access
An authenticated user with limited read privileges may be able to access documents from co...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13061
5.3
Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage
An authenticated user may be able to view session metadata belonging to other users on the...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13062
7.1
MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters
An authenticated user with write privileges on a Queryable Encryption-enabled collection m...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13063
5.3
libmongocrypt Improper Input Validation Leading to Process Termination
An authenticated user with standard read/write privileges can cause the mongod process to ...
Affects:
MongoDB Server
Versions:
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13064
7.1
MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service
Certain query operations involving deeply nested $jsonSchema constructs can trigger dispro...
Affects:
MongoDB Server
Versions:
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13065
7.1
MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination
A user with read-only privileges is able to craft an aggregation pipeline using the $linea...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13066
7.1
Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side ...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13067
7.2
tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 cl...
Affects:
MongoDB Server
Versions:
8.0 affects versions prior to 8.0.28
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13068
2.3
MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse
An authenticated user holding cursor termination privileges on one database may incorrectl...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13069
7.1
Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion
An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13070
6
Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination
A MongoDB server initiating an outbound TLS connection may terminate abnormally when proce...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13071
7.1
Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination
An authenticated user with read access can cause the mongod process to be terminated throu...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13072
9.2
MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption
When compute mode is enabled on a standalone mongod instance, insufficient validation of e...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13073
5.3
MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination
An authenticated user with read-only privileges can cause the mongod process to terminate ...
Affects:
MongoDB Server
Versions:
8.0 affects versions prior to 8.0.28
Reference Link →
07/22/2026
CVE-2026-13074
6.9
Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server b...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13075
7.1
$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation
An authenticated user can cause the mongod process to be terminated by the operating syste...
Affects:
MongoDB Server
Versions:
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13076
7.1
Aggregation Framework Memory Exhaustion Leading to Process Termination
An authenticated user can cause a {{mongod}} process to be terminated by the operating sys...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13077
7.1
Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trig...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
07/22/2026
CVE-2026-13078
6.3
Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting eng...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.39
8.0 affects versions prior to 8.0.28
8.2.0 affects versions prior to 8.2.12
8.3.0 affects versions prior to 8.3.7
Reference Link →
06/12/2026
CVE-2026-11933
8.8
Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion
A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine wh...
Affects:
MongoDB
Versions:
8.3.0 affects 8.3.3 and prior versions
8.2.0 affects 8.2.10 and prior versions
8.0.0 affects 8.0.25 and prior versions
7.0.0 affects 7.0.36 and prior versions
6.0 affects 6.0.28 and prior versions
5.0 affects 5.0.33 and prior versions
4.4.0 affects 4.4.30 and prior versions
Reference Link →
06/09/2026
CVE-2026-9740
8.7
Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow
A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user t...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.3
8.2.0 affects versions prior to 8.2.10
8.0.0 affects versions prior to 8.0.24
7.0.0 affects versions prior to 7.0.35
Reference Link →
06/09/2026
CVE-2026-9735
6.8
Keyfile contents are in MongoDB Server logs
MongoDB server may log authentication parameters, including credentials, to the server log...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.3
Reference Link →
06/09/2026
CVE-2026-9754
7.1
Stack memory disclosure in filemd5 command
An authenticated user with the read role may read limited amounts of uninitialized stack m...
Affects:
MongoDB
Versions:
8.3.0 affects versions prior to 8.3.3
8.2.0 affects versions prior to 8.2.10
Reference Link →
06/09/2026
CVE-2026-9753
7.2
Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a documen...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.3
8.2.0 affects versions prior to 8.2.10
8.0.0 affects versions prior to 8.0.24
7.0.0 affects versions prior to 7.0.35
Reference Link →
06/09/2026
CVE-2026-9752
7.1
GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation
An authorized user could trigger a server crash by running a query with a 2dsphere index o...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.3
8.2.0 affects versions prior to 8.2.10
8.0.0 affects versions prior to 8.0.24
7.0.0 affects versions prior to 7.0.35
Reference Link →
06/09/2026
CVE-2026-9751
6.8
Sensitive data could be written to mongod.log
The ldapQueryPassword parameter, when set through the runtime setParameter command, will l...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.3
8.2.0 affects versions prior to 8.2.10
8.0.0 affects versions prior to 8.0.24
7.0.0 affects versions prior to 7.0.35
Reference Link →
06/09/2026
CVE-2026-9750
7.1
Metadata name collision on $-prefixed fields causes post-auth server crash
An authenticated user can cause a MongoDB server to crash or return incorrect results by c...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.3
8.2.0 affects versions prior to 8.2.10
8.0.0 affects versions prior to 8.0.24
7.0.0 affects versions prior to 7.0.35
Reference Link →
06/09/2026
CVE-2026-9749
7.1
Using MaxKey() may crash the server
This issue can occur when running an aggregation pipeline that uses the internal $exchange...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.3
8.2.0 affects versions prior to 8.2.10
8.0.0 affects versions prior to 8.0.24
7.0.0 affects versions prior to 7.0.35
Reference Link →
06/09/2026
CVE-2026-9748
7.1
$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip t...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.3
8.2.0 affects versions prior to 8.2.10
8.0.0 affects versions prior to 8.0.10
7.0.0 affects versions prior to 7.0.35
Reference Link →
06/09/2026
CVE-2026-9747
7.1
Crafted cross-shard merge aggregation crashes MongoDB Server
Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mo...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.3
8.2.0 affects versions prior to 8.2.10
8.0.0 affects versions prior to 8.0.24
7.0.0 affects versions prior to 7.0.35
Reference Link →
06/09/2026
CVE-2026-9746
7.1
Server crashes in case of the use of exchange
When using $changestreams and $_requestReshardingResumeToken with the exchange option the ...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.3
8.2.0 affects versions prior to 8.2.10
8.0.0 affects versions prior to 8.0.24
7.0.0 affects versions prior to 7.0.35
Reference Link →
06/09/2026
CVE-2026-9743
7.1
Aggregation sub-pipeline null dereference may allow DoS via crafted getMore
In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during p...
Affects:
MongoDB server
Versions:
8.0.0 affects versions prior to 8.0.24
Reference Link →
06/09/2026
CVE-2026-9742
8.2
Authenticate command with specific mechanism parameter can trigger server crash
When OIDC authentication is enabled in configuration, clients may set specific values in t...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.3
8.2.0 affects versions prior to 8.2.10
Reference Link →
06/09/2026
CVE-2026-9741
7.1
Client side encryption fails to encrypt values in a $vectorSearch
A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable En...
Affects:
MongoDB Server
Versions:
8.3.0 affects versions prior to 8.3.3
8.2.0 affects versions prior to 8.2.10
8.0.0 affects versions prior to 8.0.24
7.0.0 affects versions prior to 7.0.35
Reference Link →
05/20/2026
CVE-2026-9101
5.3
Prototype pollution in csv parsing
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (b...
Affects:
Compass
Versions:
1.36.3
1.36.4
1.37.0
1.38.0
1.38.1
1.38.2
1.39.0
1.39.1
1.39.2
1.39.3
1.39.4
1.40.0
1.40.1
1.40.2
1.40.3
1.40.4
1.41.0
1.42.0
1.42.1
1.42.2
1.42.3
1.42.5
1.43.0
1.43.1
1.43.2
1.43.3
1.43.4
1.43.5
1.43.6
1.44.0
1.44.3
1.44.4
1.44.5
1.44.6
1.44.7
1.45.0
1.45.1
1.45.2
1.45.3
1.45.4
1.46.0
1.46.1
1.46.2
1.46.3
1.46.4
1.46.5
1.46.6
1.46.7
1.46.8
1.46.9
1.46.10
1.46.11
1.47.0
1.47.1
1.48.0
1.48.1
1.48.2
1.49.0
1.49.1
1.49.2
1.49.3
1.49.4
1.49.5
Reference Link →
05/20/2026
CVE-2026-9100
6
Heap memory out of bounds read and crash in C Driver legacy GridFS file reader
The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database...
Affects:
C Driver
Versions:
1.0 affects versions prior to 1.30.8
2.0 affects versions prior to 2.2.4
Reference Link →
05/18/2026
CVE-2026-8843
7.1
Calling createIndex with certain index types can crash mongod
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.32
8.0 affects versions prior to 8.0.21
8.2 affects versions prior to 8.2.6
Reference Link →
05/14/2026
CVE-2026-6811
6
PHP Stack Exhaustion
Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes whe...
Affects:
PHP Driver
Versions:
1.21.5
2.1.8
Reference Link →
05/13/2026
CVE-2026-8202
5.3
Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators
Using a densely populated chars mask and a large input string in the MongoDB aggregation o...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.34
8.0 affects versions prior to 8.0.23
8.2 affects versions prior to 8.2.9
8.3 affects versions prior to 8.3.2
Reference Link →
05/13/2026
CVE-2026-8336
7.7
Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands
After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapre...
Affects:
MongoDB Server
Versions:
8.2 affects versions prior to 8.2.9
8.3 affects versions prior to 8.3.2
Reference Link →
05/13/2026
CVE-2026-8201
6.1
Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields
A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query anal...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.34
8.0 affects versions prior to 8.0.23
8.2 affects versions prior to 8.2.9
8.3 affects versions prior to 8.3.2
Reference Link →
05/13/2026
CVE-2026-8200
4.8
Schema validation log messages may not redact user data
When schema validation is enabled on a collection and an update or insert would violate th...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.34
8.0 affects versions prior to 8.0.23
8.2 affects versions prior to 8.2.9
8.3 affects versions prior to 8.3.2
Reference Link →
05/13/2026
CVE-2026-8199
7.1
Post-auth memory exhaustion via bitwise match expressions
An authenticated user can cause excess memory usage via bitwise match expression AST proce...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.34
8.0 affects versions prior to 8.0.23
8.2 affects versions prior to 8.2.9
8.3 affects versions prior to 8.3.2
Reference Link →
05/12/2026
CVE-2026-8053
8.7
FlatBSON Duplicate Field Index Drift
An issue in MongoDB Server's time-series collection implementation allows an authenticated...
Affects:
MongoDB Server
Versions:
5.0 affects versions prior to 5.0.33
6.0 affects versions prior to 6.0.28
7.0 affects versions prior to 7.0.34
8.0 affects versions prior to 8.0.23
8.2 affects versions prior to 8.2.9
8.3 affects versions prior to 8.3.2
Reference Link →
05/12/2026
CVE-2026-8431
9.4
Ops Manager RCE via webhook body
An administrative user with access to configure webhooks can execute arbitrary commands by...
Affects:
Ops Manager
Versions:
7.0 affects versions prior to 8.0.23
Reference Link →
05/07/2026
CVE-2026-8063
7.1
Post-auth null pointer dereference when aggregating against a view with empty search pipeline
An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an em...
Affects:
MongoDB Server
Versions:
8.2.0 affects versions prior to 8.2.7
Reference Link →
05/06/2026
CVE-2026-6691
8.6
MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow
The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during userna...
Affects:
MongoDB C Driver
Versions:
2.1.0 affects 2.1.2 and prior versions
Reference Link →
04/29/2026
CVE-2026-6915
5.3
Flaw in the updateUser Command May Allow Unauthorized Configuration Change
An authorization flaw in the user management command could allow an authenticated user to ...
Affects:
MongoDB Server
Versions:
8.2.0 affects versions prior to 8.2.7
8.0.0 affects versions prior to 8.0.21
7.0.0 affects versions prior to 7.0.32
Reference Link →
04/29/2026
CVE-2026-6914
7.1
MD5 checksum creation may cause availability loss
Computing the MD5 checksum of a malformed BSON object under specific conditions may cause ...
Affects:
MongoDB Server
Versions:
8.2.0 affects versions prior to 8.2.7
8.1.0 affects 8.1.* and prior versions
8.0.0 affects versions prior to 8.0.21
7.0.0 affects versions prior to 7.0.32
Reference Link →
04/13/2026
CVE-2026-6231
5.3
bson_validate may skip validation when processing certain inputs
The bson_validate function may return early on specific inputs and incorrectly report succ...
Affects:
C Driver
Versions:
1.0 affects versions prior to 1.30.5
2.0 affects versions prior to 2.0.2
Reference Link →
03/30/2026
CVE-2026-5170
6
Users could trigger a crash of mongod primaries during promotion to sharded
A user with access to the cluster with a limited set of privilege actions can trigger a cr...
Affects:
MongoDB Server
Versions:
8.2 affects versions prior to 8.2.2
8.0 affects versions prior to 8.0.18
7.0 affects versions prior to 7.0.31
Reference Link →
03/17/2026
CVE-2026-4359
2
Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer
A compromised third party cloud server or man-in-the-middle attacker could send a malforme...
Affects:
MongoDB C Driver
Versions:
affects versions prior to 2.2.3
Reference Link →
03/17/2026
CVE-2026-4358
6.1
Memory safety issues in slot-based execution hash table spill
A specially crafted aggregation query with $lookup by an authenticated user with write pri...
Affects:
MongoDB Server
Versions:
8.2 affects versions prior to 8.2.6
8.0 affects versions prior to 8.0.20
7.0 affects versions prior to 7.0.31
Reference Link →
03/17/2026
CVE-2026-4148
8.7
ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators
A use-after-free vulnerability can be triggered in sharded clusters by an authenticated us...
Affects:
MongoDB Server
Versions:
8.2 affects versions prior to 8.2.6
8.0 affects versions prior to 8.0.20
7.0 affects versions prior to 7.0.31
Reference Link →
03/17/2026
CVE-2026-4147
7.1
Stack memory disclosure in filemd5 command
An authenticated user with the read role may read limited amounts of uninitialized stack m...
Affects:
MongoDB Server
Versions:
8.2 affects versions prior to 8.2.6
8.0 affects versions prior to 8.0.20
7.0 affects versions prior to 7.0.31
Reference Link →
02/10/2026
CVE-2026-2303
6.9
Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak
The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication ...
Affects:
MongoDB Go Driver
Versions:
1.0.0 affects versions prior to 1.17.7
2.0.0 affects versions prior to 2.4.2
Reference Link →
02/10/2026
CVE-2026-2302
6.9
Unsafe Reflection in Mongoid::Criteria.from_hash
Under specific conditions when processing a maliciously crafted value of type Hash r, Mong...
Affects:
MongoDB Ruby Driver
Versions:
7.0.0 affects 7.6.1 and prior versions
8.0.0 affects 8.0.12 and prior versions
8.1.0 affects 8.1.12 and prior versions
9.0.0 affects 9.0.10 and prior versions
Reference Link →
02/10/2026
CVE-2026-25613
7.1
An unsafe cast in the MongoDB query planner can result in a segmentation fault.
An authorized user may disable the MongoDB server by issuing a query against a collection ...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.29
8.0 affects versions prior to 8.0.18
8.2 affects versions prior to 8.2.4
Reference Link →
02/10/2026
CVE-2026-1849
7.1
Mongod can run out of stack memory when expressions create deeply nested documents
MongoDB Server may experience an out-of-memory failure while evaluating expressions that p...
Affects:
MongoDB Server
Versions:
8.0 affects versions prior to 8.0.18
7.0 affects versions prior to 7.0.29
8.2 affects versions prior to 8.2.2
Reference Link →
02/10/2026
CVE-2026-1850
7.1
An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification
Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an ...
Affects:
MongoDB Server
Versions:
8.0 affects versions prior to 8.0.18
8.2 affects versions prior to 8.2.4
Reference Link →
02/10/2026
CVE-2026-25609
5.3
profile command may permit unauthorized configuration
Incorrect validation of the profile command may result in the determination that a request...
Affects:
MongoDB Server
Versions:
8.2 affects versions prior to 8.2.4
8.0 affects versions prior to 8.0.18
7.0 affects versions prior to 7.0.29
Reference Link →
02/10/2026
CVE-2026-25610
7.1
Invalid $geoNear index hint may cause server crash
An authorized user may trigger a server crash by running a $geoNear pipeline with certain ...
Affects:
MongoDB Server
Versions:
8.0 affects versions prior to 8.0.13
7.0 affects versions prior to 7.0.29
Reference Link →
02/10/2026
CVE-2026-1848
8.2
Connections received from the proxy port may not count towards total accepted connections
Connections received from the proxy port may not count towards total accepted connections,...
Affects:
MongoDB Server
Versions:
8.2 affects versions prior to 8.2.4
8.0 affects versions prior to 8.0.18
7.0 affects versions prior to 7.0.29
Reference Link →
02/10/2026
CVE-2026-1847
7.1
MongoDB Server may crash when inserting large documents
Inserting certain large documents into a replica set could lead to replica set secondaries...
Affects:
MongoDB Server
Versions:
8.0 affects versions prior to 8.0.18
7.0 affects versions prior to 7.0.29
Reference Link →
02/10/2026
CVE-2026-25612
7.1
Internal ResourceId collision may affect unrelated collections
The internal locking mechanism of the MongoDB server uses an internal encoding of the reso...
Affects:
MongoDB Server
Versions:
8.2 affects versions prior to 8.2.4
8.0 affects versions prior to 8.0.18
7.0 affects versions prior to 7.0.29
Reference Link →
02/10/2026
CVE-2026-25611
8.7
Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server
A series of specifically crafted, unauthenticated messages can exhaust available memory an...
Affects:
MongoDB Server
Versions:
8.2 affects versions prior to 8.2.4
8.0 affects versions prior to 8.0.18
7.0 affects versions prior to 7.0.29
Reference Link →
01/27/2026
CVE-2025-14911
7.1
Integer Overflow in GridFS chunkSize Leading to Heap Allocation Failure
User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malf...
Affects:
Mongo-c-driver
Versions:
affects versions prior to 2.1.3
Reference Link →
12/19/2025
CVE-2025-14847
8.7
Zlib compressed protocol header length confusion may allow memory read
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitial...
Affects:
MongoDB Server
Versions:
8.2 affects versions prior to 8.2.3
8.0 affects versions prior to 8.0.17
7.0 affects versions prior to 7.0.28
6.0 affects versions prior to 6.0.27
5.0 affects versions prior to 5.0.32
4.4 affects versions prior to 4.4.30
4.2
4.0
3.6
Reference Link →
12/09/2025
CVE-2025-14345
4.2
Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server
A post-authentication flaw in the network two-phase commit protocol used for cross-shard t...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.26
8.0 affects versions prior to 8.0.16
8.2 affects versions prior to 8.2.2
Reference Link →
11/25/2025
CVE-2025-13644
6.5
MongoDB may be susceptible to Invariant Failure due to batched delete
MongoDB Server may experience an invariant failure during batched delete operations when h...
Affects:
MongoDB Server
Versions:
8.0 affects versions prior to 8.0.13
7.0 affects versions prior to 7.0.26
8.1 affects versions prior to 8.1.2
Reference Link →
11/25/2025
CVE-2025-13643
3.1
MongoDB Server may allow queries to be terminated by unauthorized users
A user with access to the cluster with a limited set of privilege actions may be able to t...
Affects:
MongoDB Server
Versions:
8.0 affects versions prior to 8.0.14
7.0 affects versions prior to 7.0.26
Reference Link →
11/25/2025
CVE-2025-12893
4.2
Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server
Clients may successfully perform a TLS handshake with a MongoDB server despite presenting ...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.26
8.0 affects versions prior to 8.0.16
8.2 affects versions prior to 8.2.2
Reference Link →
11/25/2025
CVE-2025-13507
7.1
Time-series operations may cause internal BSON size limit to be exceed
Inconsistent object size validation in time series processing logic may result in later pr...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.26
8.0 affects versions prior to 8.0.16
8.2 affects versions prior to 8.2.1
Reference Link →
11/18/2025
CVE-2025-12119
Bulk write with options may read invalid memory
A mongoc_bulk_operation_t may read invalid memory if large options are passed.
Affects:
C Driver
Versions:
1.9.0 affects 1.30.5 and prior versions
2.0.0 affects 2.1.1 and prior versions
Affects:
PHP Driver
Versions:
affects 2.1.2 and prior versions
Reference Link →
11/03/2025
CVE-2025-12657
Malformed KMIP response may result in access violation
The KMIP response parser built into mongo binaries is overly tolerant of certain malformed...
Affects:
MongoDB Server
Versions:
6.0 affects versions prior to 7.0.22
8.0 affects versions prior to 8.0.10
Reference Link →
10/23/2025
CVE-2025-12100
MongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directories
Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Pri...
Affects:
BI Connector ODBC driver
Versions:
1.0.0 affects 1.4.6 and prior versions
Reference Link →
10/23/2025
CVE-2025-11575
MongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directories
Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows al...
Affects:
Atlas SQL ODBC driver
Versions:
1.0.0 affects 2.0.0 and prior versions
Reference Link →
10/20/2025
CVE-2025-11979
5.3
Use-after-free in the MongoDB server query planner may lead to crash or undefined behavior
An authorized user may crash the MongoDB server by causing buffer over-read. This can be d...
Affects:
Server
Versions:
8.2.0
8.0.0 affects versions prior to 8.0.14
7.0.0 affects versions prior to 7.0.25
Reference Link →
10/13/2025
CVE-2025-11695
8
Configuration may unexpectedly disable certificate validation
When tlsInsecure=False appears in a connection string, certificate validation is disabled....
Affects:
Rust Driver
Versions:
affects versions prior to v3.2.5
Reference Link →
10/08/2025
CVE-2025-11535
MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories
MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom insta...
Affects:
MongoDB Connector for BI
Versions:
2.0.0 affects 2.14.24 and prior versions
Reference Link →
09/15/2025
CVE-2025-10491
7.8
MongoDB Windows installation MSI may leave ACLs unset on custom installation directories
The MongoDB Windows installation MSI may leave ACLs unset on custom installation directori...
Affects:
MongoDB Server
Versions:
6.0 affects versions prior to 6.0.25
7.0 affects versions prior to 7.0.21
8.0 affects versions prior to 8.0.5
Reference Link →
09/05/2025
CVE-2025-10061
6.5
Malformed $group Query May Cause MongoDB Server to Crash
An authorized user can cause a crash in the MongoDB Server through a specially crafted $gr...
Affects:
MongoDB Server
Versions:
6.0 affects versions prior to 6.0.25
7.0 affects versions prior to 7.0.22
8.0 affects versions prior to 8.0.12
8.1 affects versions prior to 8.1.2
Reference Link →
09/05/2025
CVE-2025-10060
6.5
MongoDB may be susceptible to Invariant Failure in Transactions due Upsert Operation
MongoDB Server may allow upsert operations retried within a transaction to violate unique ...
Affects:
MongoDB Server
Versions:
6.0 affects versions prior to 6.0.25
7.0 affects versions prior to 7.0.22
8.0 affects versions prior to 8.0.12
Reference Link →
09/05/2025
CVE-2025-10059
6.5
MongoDB Server router will crash when incorrect lsid is set on a sharded query
An improper setting of the lsid field on any sharded query can cause a crash in MongoDB ro...
Affects:
MongoDB Server
Versions:
6.0 affects versions prior to 6.0.24
7.0 affects versions prior to 7.0.18
8.0 affects versions prior to 8.0.6
Reference Link →
07/07/2025
CVE-2025-7259
6.5
Certain Queries with Duplicate _id Fields May Cause MongoDB Server to Crash
An authorized user can issue queries with duplicate _id fields, that leads to unexpected b...
Affects:
MongoDB Server
Versions:
8.1 affects 8.1.0 and prior versions
Reference Link →
07/07/2025
CVE-2025-6714
7.5
Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections
MongoDB Server's mongos component can become unresponsive to new connections due to incorr...
Affects:
MongoDB Server
Versions:
6.0 affects versions prior to 6.0.23
7.0 affects versions prior to 7.0.20
8.0 affects versions prior to 8.0.9
Reference Link →
07/07/2025
CVE-2025-6713
7.7
MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage
An unauthorized user may leverage a specially crafted aggregation pipeline to access data ...
Affects:
MongoDB Server
Versions:
6.0 affects versions prior to 6.0.22
7.0 affects versions prior to 7.0.19
8.0 affects versions prior to 8.0.7
Reference Link →
07/07/2025
CVE-2025-6712
6.5
MongoDB Server may be susceptible to DoS due to Accumulated Memory Allocation
MongoDB Server may be susceptible to disruption caused by high memory usage, potentially l...
Affects:
MongoDB Server
Versions:
8.0 affects versions prior to 8.0.10
Reference Link →
07/07/2025
CVE-2025-6711
4.4
Incomplete Redaction of Sensitive Information in MongoDB Server Logs
An issue has been identified in MongoDB Server where unredacted queries may inadvertently ...
Affects:
MongoDB Server
Versions:
6.0 affects versions prior to 6.0.21
7.0 affects versions prior to 7.0.18
8.0 affects versions prior to 8.0.5
Reference Link →
06/26/2025
CVE-2025-6710
7.5
Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB
MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where s...
Affects:
MongoDB Server
Versions:
6.0 affects versions prior to 6.0.21
7.0 affects versions prior to 7.0.17
8.0 affects versions prior to 8.0.5
Reference Link →
06/26/2025
CVE-2025-6709
7.5
Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC Authentication
The MongoDB Server is susceptible to a denial of service vulnerability due to improper han...
Affects:
MongoDB Server
Versions:
7.0 affects versions prior to 7.0.17
8.0 affects versions prior to 8.0.5
6.0 affects versions prior to 6.0.21
Reference Link →
06/26/2025
CVE-2025-6707
4.2
Race condition in privilege cache invalidation cycle
Under certain conditions, an authenticated user request may execute with stale privileges ...
Affects:
MongoDB Server
Versions:
5.0 affects versions prior to 5.0.31
6.0 affects versions prior to 6.0.24
7.0 affects versions prior to 7.0.21
8.0 affects versions prior to 8.0.5
Reference Link →
06/26/2025
CVE-2025-6706
5
Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server
An authenticated user may trigger a use after free that may result in MongoDB Server crash...
Affects:
MongoDB Server
Versions:
6.0 affects versions prior to 6.0.21
7.0 affects versions prior to 7.0.17
8.0 affects versions prior to 8.0.4
Reference Link →
04/01/2025
CVE-2025-3085
8.1
MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked
A MongoDB server under specific conditions running on Linux with TLS and CRL revocation st...
Affects:
MongoDB Server
Versions:
5.0 affects versions prior to 5.0.31
6.0 affects versions prior to 6.0.20
7.0 affects versions prior to 7.0.16
8.0. affects versions prior to 8.0.4
Reference Link →
04/01/2025
CVE-2025-3084
6.5
MongoDB Server may crash due to improper validation of explain command
When run on commands with certain arguments set, explain may fail to validate these argume...
Affects:
MongoDB Server
Versions:
5.0 affects versions prior to 5.0.31
6.0 affects versions prior to 6.0.20
7.0 affects versions prior to 7.0.16
8.0 affects versions prior to 8.0.4
Reference Link →
04/01/2025
CVE-2025-3083
7.5
Malformed MongoDB wire protocol messages may cause mongos to crash
Specifically crafted MongoDB wire protocol messages can cause mongos to crash during comma...
Affects:
MongoDB Server
Versions:
5.0 affects versions prior to 5.0.31
6.0 affects versions prior to 6.0.20
7.0. affects versions prior to 7.0.16
Reference Link →
04/01/2025
CVE-2025-3082
3.1
User may override a view's collation and gain unauthorized access to underlying data
A user authorized to access a view may be able to alter the intended collation, allowing t...
Affects:
MongoDB Server
Versions:
5.0 affects versions prior to 5.0.31
6.0 affects versions prior to 6.0.20
7.0 affects versions prior to 7.0.14
7.3 affects versions prior to 7.3.4
Reference Link →
03/18/2025
CVE-2025-0755
8.4
MongoDB C Driver bson library may be susceptible to buffer overflow
The various bson_append functions in the MongoDB C driver library may be susceptible to bu...
Affects:
libbson
Versions:
affects versions prior to 1.27.5
Affects:
MongoDB Server
Versions:
8.0 affects versions prior to 8.0.1
7.0 affects versions prior to 7.0.16
Reference Link →
02/27/2025
CVE-2025-1756
7.5
MongoDB Shell may be susceptible to local privilege escalation in Windows
mongosh may be susceptible to local privilege escalation under certain conditions potentia...
Affects:
mongosh
Versions:
affects versions prior to 2.3.0
Reference Link →
02/27/2025
CVE-2025-1755
7.5
MongoDB Compass may be susceptible to local privilege escalation in Windows
MongoDB Compass may be susceptible to local privilege escalation under certain conditions ...
Affects:
MongoDB Compass
Versions:
affects versions prior to 1.42.1
Reference Link →
02/27/2025
CVE-2025-1693
3.9
MongoDB Shell may be susceptible to control character Injection via shell output
The MongoDB Shell may be susceptible to control character injection where an attacker with...
Affects:
mongosh
Versions:
affects versions prior to 2.3.9
Reference Link →
02/27/2025
CVE-2025-1692
6.3
MongoDB Shell may be susceptible to control character injection via pasting
The MongoDB Shell may be susceptible to control character injection where an attacker with...
Affects:
mongosh
Versions:
affects versions prior to 2.3.9
Reference Link →
02/27/2025
CVE-2025-1691
7.6
MongoDB Shell may be susceptible to Control Character Injection via autocomplete
The MongoDB Shell may be susceptible to control character injection where an attacker with...
Affects:
mongosh
Versions:
affects versions prior to 2.3.9
Reference Link →
11/14/2024
CVE-2024-10921
6.8
Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server
An authorized user may trigger crashes or receive the contents of buffer over-reads of Ser...
Affects:
MongoDB Server
Versions:
5.0 affects versions prior to 5.0.30
6.0 affects versions prior to 6.0.19
7.0 affects versions prior to 7.0.15
8.0 affects versions prior to 8.0.3
Reference Link →
10/28/2024
CVE-2024-8013
2.2
CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines
A bug in query analysis of certain complex self-referential $lookup subpipelines may resul...
Affects:
mongocryptd
Versions:
5.0 affects versions prior to 5.0.29
6.0 affects versions prior to 6.0.17
7.0 affects versions prior to 7.012
7.3 affects versions prior to 7.3.4
Affects:
Mongo_crypt_v1.so
Versions:
6.0 affects versions prior to 6.0.17
7.0 affects versions prior to 7.0.12
7.3 affects versions prior to 7.3.4
Reference Link →
10/21/2024
CVE-2024-8305
6.5
MongoDB Server secondaries may crash due to forced index constraints
prepareUnique index may cause secondaries to crash due to incorrect enforcement of index c...
Affects:
MongoDB Server
Versions:
6.0 affects versions prior to 6.0.17
7.0 affects versions prior to 7.0.13
7.3 affects versions prior to 7.3.4
Reference Link →
09/10/2024
CVE-2024-8654
5
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour...
Affects:
MongoDB Server
Versions:
6.0.3
Reference Link →
08/27/2024
CVE-2024-8207
6.4
MongoDB Server binaries may load potentially insecure shared libraries from specific relative paths
In certain highly specific configurations of the host system and MongoDB server binary ins...
Affects:
MongoDB Server
Versions:
6.0 affects versions prior to 6.0.3
5.0 affects versions prior to 5.0.14
Reference Link →
08/13/2024
CVE-2024-6384
5.3
Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server
"Hot" backup files may be downloaded by underprivileged users, if they are capable of acqu...
Affects:
MongoDB Server
Versions:
6.0 affects versions prior to 6.0.16
7.0 affects versions prior to 7.0.11
7.3 affects versions prior to 7.3.3
Reference Link →
08/07/2024
CVE-2024-7553
7.3
Accessing Untrusted Directory May Allow Local Privilege Escalation
Incorrect validation of files loaded from a local untrusted directory may allow local priv...
Affects:
MongoDB Server
Versions:
5.0 affects versions prior to 5.0.27
6.0 affects versions prior to 6.0.16
7.0 affects versions prior to 7.0.12
7.3 affects versions prior to 7.3.3
Affects:
MongoDB C Driver
Versions:
affects versions prior to 1.26.2
Affects:
MongoDB PHP Driver
Versions:
affects versions prior to 1.18.1
Reference Link →
07/03/2024
CVE-2024-6383
5.3
MongoDB C Driver bson_string_append may be vulnerable to a buffer overflow
The bson_string_append function in MongoDB C Driver may be vulnerable to a buffer overflow...
Affects:
libbson
Versions:
0 affects versions prior to 1.27.1
Reference Link →
07/02/2024
CVE-2024-6382
6.4
Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing...
Affects:
MongoDB Rust Driver
Versions:
2.0 affects versions prior to 2.8.2
Reference Link →
07/02/2024
CVE-2024-6381
4
MongoDB C Driver bson_strfreev may be susceptible to integer overflow
The bson_strfreev function in the MongoDB C driver library may be susceptible to an intege...
Affects:
libbson
Versions:
affects versions prior to 1.26.2
Reference Link →
07/01/2024
CVE-2024-6376
7
ejson shell parser in MongoDB Compass maybe bypassed
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protectio...
Affects:
MongoDB Compass
Versions:
affects versions prior to 1.42.2
Reference Link →
07/01/2024
CVE-2024-6375
5.4
Missing authorization check may lead to shard key refinement
A command for refining a collection shard key is missing an authorization check. This may ...
Affects:
MongoDB Server
Versions:
5.0 affects versions prior to 5.0.22
6.0 affects versions prior to 6.0.11
7.0 affects versions prior to 7.0.3
Reference Link →
06/05/2024
CVE-2024-5629
4.7
Out-of-bounds read in bson module of PyMongo
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserializat...
Affects:
PyMongo
Versions:
affects 4.6.2 and prior versions
Reference Link →
05/14/2024
CVE-2024-3374
5.3
MongoDB Server (mongod) may crash when generating ftdc
An unauthenticated user can trigger a fatal assertion in the server while generating ftdc ...
Affects:
MongoDB Server
Versions:
5.0 affects 5.0.16 and prior versions
6.0 affects 6.0.5 and prior versions
Reference Link →
05/14/2024
CVE-2024-3372
7.5
MongoDB Server may have unexpected application behaviour due to invalid BSON
Improper validation of certain metadata input may result in the server not correctly seria...
Affects:
MongoDB Server
Versions:
5.0 affects versions prior to 5.0.25
6.0 affects versions prior to 6.0.14
7.0 affects versions prior to 7.0.6
Reference Link →
04/24/2024
CVE-2024-3371
7.1
Insufficient validation of external input in Compass may enable MITM attacks
MongoDB Compass may accept and use insufficiently validated input from an untrusted extern...
Affects:
MongoDB Compass
Versions:
affects 1.35.0 to 1.42.0
Reference Link →
03/07/2024
CVE-2024-1351
8.8
MongoDB Server may allow successful untrusted connection
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer c...
Affects:
MongoDB Server
versions:
7.0 affects 7.0.5 and prior versions
6.0 affects 6.0.13 and prior versions
5.0 affects 5.0.24 and prior versions
4.4 affects 4.4.28 and prior versions
Reference Link →
01/12/2024
CVE-2023-0437
5.3
MongoDB client C Driver may infinitely loop when validating certain BSON input data
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot b...
Affects:
MongoDB C Driver
versions:
1.0.0 affects versions prior to 1.25.0
Reference Link →
11/07/2023
CVE-2023-0436
4.5
Secret logging may occur in debug mode of Atlas Operator
The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information...
Affects:
MongoDB Atlas Kubernetes Operator
versions:
1.5.0 affects 1.7.0 and prior versions
Reference Link →
08/29/2023
CVE-2021-32050
4.2
Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application
Some MongoDB Drivers may erroneously publish events containing authentication-related data...
Affects:
MongoDB C Driver
Versions:
1.0.0 affects versions prior to 1.17.7
Affects:
MongoDB C++ Driver
Versions:
3.0.0 affects versions prior to 3.7.0
Affects:
MongoDB PHP Driver
Versions:
1.0.0 affects versions prior to 1.9.2
Affects:
MongoDB Swift Driver
Versions:
1.0.0 affects versions prior to 1.1.1
Affects:
MongoDB Node.js Driver
Versions:
3.6 affects versions prior to 3.6.10
4.0 affects versions prior to 4.17.0
5.0 affects versions prior to 5.8.0
Reference Link →
08/23/2023
CVE-2023-1409
5.3
Certificate validation issue in MongoDB Server running on Windows or macOS
If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific...
Affects:
MongoDB Server
versions:
6.3 affects 6.3.2 and prior versions
5.0 affects 5.0.14 and prior versions
4.4 affects 4.4.23 and prior versions
Reference Link →
08/08/2023
CVE-2023-4009
7.2
Privilege Escalation for Project Owner and Project User Admin Roles in Ops Manager
In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an...
Affects:
MongoDB Ops Manager
versions:
6.0 affects versions prior to 6.0.17
5.0 affects versions prior to 5.0.22
Reference Link →
06/09/2023
CVE-2023-0342
3.1
MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive
MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app...
Affects:
MongoDB Ops Manager
versions:
v5.0 affects versions prior to 5.0.21
v6.0 affects versions prior to 6.0.12
Reference Link →
02/21/2023
CVE-2022-48282
6.6
Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution
Under very specific circumstances (see Required configuration section below), a privileged...
Affects:
MongoDB .NET/C# Driver
versions:
0 affects v2.18.0 and prior versions
Reference Link →
05/11/2022
CVE-2022-24272
6.5
MongoDB Server (mongod) may crash in response to unexpected requests
An authenticated user may trigger an invariant assertion during command dispatch due to in...
Affects:
MongoDB Server
versions:
5.0 affects 5.0.6 and prior versions
Reference Link →
04/12/2022
CVE-2021-32040
6.5
Large aggregation pipelines with a specific stage can crash mongod under default configuration
It may be possible to have an extremely long aggregation pipeline in conjunction with a sp...
Affects:
MongoDB Server
versions:
5.0 affects versions prior to 5.0.4
4.4 affects versions prior to 4.4.11
4.2 affects versions prior to 4.2.16
Reference Link →
02/04/2022
CVE-2021-32036
5.4
Denial of Service and Data Integrity vulnerability in features command
An authenticated user without any specific authorizations may be able to repeatedly invoke...
Affects:
MongoDB Server
versions:
5.0 affects 5.0.3 and prior versions
4.4 affects 4.4.9 and prior versions
4.2 affects 4.2.16 and prior versions
4.0 affects 4.0.28 and prior versions
Reference Link →
01/20/2022
CVE-2021-32039
5.5
MongoDB Extension for VS Code may unexpectedly store credentials locally in clear text
Users with appropriate file access may be able to access unencrypted user credentials save...
Affects:
MongoDB for VS Code
versions:
MongoDB for VS Code affects 0.7.0 and prior versions
Reference Link →
12/15/2021
CVE-2021-20330
6.5
Specific replication command with malformed oplog entries can crash secondaries
An attacker with basic CRUD permissions on a replicated collection can run the applyOps co...
Affects:
MongoDB Server
versions:
4.0 affects versions prior to 4.0.27
4.2 affects versions prior to 4.2.16
4.4 affects versions prior to 4.4.9
Reference Link →
11/24/2021
CVE-2021-32037
6.5
User may trigger invariant when allowed to send commands directly to shards
An authorized user may trigger an invariant which may result in denial of service or serve...
Affects:
MongoDB Server
versions:
5.0 affects 5.0.2 and prior versions
Reference Link →
08/02/2021
CVE-2021-20332
4.2
MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an application
Specific MongoDB Rust Driver versions can include credentials used by the connection pool ...
Affects:
MongoDB Rust Driver
versions:
2.0.0-alpha
2.0.0-alpha1
1.0.0 affects 1.2.1 and prior versions
Reference Link →
07/23/2021
CVE-2021-20333
5.3
Server log entry spoofing via newline injection
Sending specially crafted commands to a MongoDB Server may result in artificial log entrie...
Affects:
MongoDB Server
versions:
3.6 affects versions prior to 3.6.20
4.0 affects versions prior to 4.0.21
4.2 affects versions prior to 4.2.10
Reference Link →
06/10/2021
CVE-2021-20329
6.8
Specific cstrings input may not be properly validated in the Go Driver
Specific cstrings input may not be properly validated in the MongoDB Go Driver when marsha...
Affects:
MongoDB Go Driver
versions:
1.0 affects 1.5.0 and prior versions
Reference Link →
05/24/2021
CVE-2021-20331
4.2
MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an application
Specific versions of the MongoDB C# Driver may erroneously publish events containing authe...
Affects:
MongoDB C# Driver
versions:
2.12 affects 2.12.1 and prior versions
Reference Link →
04/30/2021
CVE-2021-20326
6.5
Specially crafted query may result in a denial of service of mongod
A user authorized to performing a specific type of find query may trigger a denial of serv...
Affects:
MongoDB Server
versions:
4.4 affects versions prior to 4.4.4
Reference Link →
04/12/2021
CVE-2020-7924
4.2
Specific command line parameter might result in accepting invalid certificate
Usage of specific command line parameter in MongoDB Tools which was originally intended to...
Affects:
MongoDB Database Tools
versions:
3.6.5 affects versions prior to 3.6*
4.0 affects versions prior to 4.0.21
4.2 affects versions prior to 4.2.11
100 affects versions prior to 100.2.0
Reference Link →
04/06/2021
CVE-2021-20334
4.8
Local privilege escalation in MongoDB Compass for Windows
A malicious 3rd party with local access to the Windows machine where MongoDB Compass is in...
Affects:
MongoDB Compass
versions:
1.3.0 affects versions prior to 1.x*
Reference Link →
02/26/2021
CVE-2020-7929
6.5
Specially crafted regex query can cause DoS
A user authorized to perform database queries may trigger denial of service by issuing spe...
Affects:
MongoDB Server
versions:
3.6 affects versions prior to 3.6.21
4.0 affects versions prior to 4.0.20
Reference Link →
02/26/2021
CVE-2018-25004
4.9
Invariant failure when explaining a find with a UUID
A user authorized to performing a specific type of query may trigger a denial of service b...
Affects:
MongoDB Server
versions:
3.6 affects versions prior to 3.6.11
4.0 affects versions prior to 4.0.6
Reference Link →
02/25/2021
CVE-2021-20327
6.4
MongoDB Node.js client side field level encryption library may not be validating KMS certificate
A specific version of the Node.js mongodb-client-encryption module does not perform correc...
Affects:
mongodb-client-encryption module
versions:
1.2.0
Reference Link →
02/25/2021
CVE-2021-20328
6.4
MongoDB Java driver client-side field level encryption not verifying KMS host name
Specific versions of the Java driver that support client-side field level encryption (CSFL...
Affects:
mongo-java-driver
versions:
3.11 affects 3.11.2 and prior versions
3.12 affects 3.12.7 and prior versions
Reference Link →
02/11/2021
CVE-2021-20335
6.7
SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager
For MongoDB Ops Manager <= 4.2.24 with multiple OM application servers, that have SSL turn...
Affects:
Ops Manager
versions:
4.2 affects 4.2.24 and prior versions
Reference Link →
12/01/2020
CVE-2019-20924
6.5
Invariant in IndexBoundsBuilder
A user authorized to perform database queries may trigger denial of service by issuing spe...
Affects:
MongoDB Server
versions:
4.2 affects versions prior to 4.2.2
Reference Link →
11/30/2020
CVE-2020-7925
7.5
Denial of Service when processing malformed Role names
Incorrect validation of user input in the role name parser may lead to use of uninitialize...
Affects:
MongoDB Server
versions:
4.2 affects versions prior to 4.2.9
4.4 affects versions prior to 4.4.0-rc12
Reference Link →
11/30/2020
CVE-2020-7926
6.5
Specific query can cause a DoS against MongoDB Server
A user authorized to perform database queries may cause denial of service by issuing a spe...
Affects:
MongoDB Server
versions:
4.4 affects versions prior to 4.4.1
Reference Link →
11/30/2020
CVE-2020-7927
8.1
Potential privilege escalation in Ops Manager API
Specially crafted API calls may allow an authenticated user who holds Organization Owner p...
Affects:
MongoDB Ops Manager
versions:
4.2 affects 4.2.17 and prior versions
4.3 affects 4.3.9 and prior versions
4.4 affects 4.4.2 and prior versions
Reference Link →
11/30/2020
CVE-2019-2392
6.5
$mod can result in UB
A user authorized to perform database queries may trigger denial of service by issuing spe...
Affects:
MongoDB Server
versions:
3.6 affects versions prior to 3.6.20
4.0 affects versions prior to 4.0.20
4.2 affects versions prior to 4.2.9
4.4 affects versions prior to 4.4.1
Reference Link →
11/30/2020
CVE-2019-2393
6.5
Crash while joining collections with $lookup
A user authorized to perform database queries may trigger denial of service by issuing spe...
Affects:
MongoDB Server
versions:
3.6 affects versions prior to 3.6.15
4.0 affects versions prior to 4.0.13
4.2 affects versions prior to 4.2.1
Reference Link →
11/30/2020
CVE-2019-20923
6.5
Crash while handling internal Javascript exception types
A user authorized to perform database queries may trigger denial of service by issuing spe...
Affects:
MongoDB Server
versions:
4.0 affects versions prior to 4.0.7
Reference Link →
11/30/2020
CVE-2018-20802
6.5
Post-auth queries on compound index may crash mongod
A user authorized to perform database queries may trigger denial of service by issuing spe...
Affects:
MongoDB Server
versions:
3.6 affects versions prior to 3.6.9
4.0 affects versions prior to 4.0.3
Reference Link →
11/30/2020
CVE-2018-20804
6.5
Invariant failure in applyOps
A user authorized to perform database queries may trigger denial of service by issuing spe...
Affects:
MongoDB Server
versions:
3.6 affects versions prior to 3.6.13
4.0 affects versions prior to 4.0.10
Reference Link →
11/30/2020
CVE-2018-20805
6.5
Invariant with $elemMatch
A user authorized to perform database queries may trigger denial of service by issuing spe...
Affects:
MongoDB Server
versions:
3.6 affects versions prior to 3.6.10
4.0 affects versions prior to 4.0.5
Reference Link →
11/24/2020
CVE-2019-20925
7.5
Denial of service via malformed network packet
An unauthenticated client can trigger denial of service by issuing specially crafted wire ...
Affects:
MongoDB Server
versions:
4.2 affects versions prior to 4.2.1
4.0 affects versions prior to 4.0.13
3.6 affects versions prior to 3.6.15
3.4 affects versions prior to 3.4.24
Reference Link →
11/23/2020
CVE-2020-7928
6.5
Improper neutralization of null byte leads to read overrun
A user authorized to perform database queries may trigger a read overrun and access arbitr...
Affects:
MongoDB Server
versions:
4.4 affects versions prior to 4.4.1
4.2 affects versions prior to 4.2.9
4.0 affects versions prior to 4.0.20
3.6 affects versions prior to 3.6.20
Reference Link →
11/23/2020
CVE-2018-20803
6.5
Infinite loop in aggregation expression
A user authorized to perform database queries may trigger denial of service by issuing spe...
Affects:
MongoDB Server
versions:
4.0 affects versions prior to 4.0.5
3.6 affects versions prior to 3.6.10
3.4 affects versions prior to 3.4.19
Reference Link →
08/21/2020
CVE-2020-7923
6.5
Specific GeoQuery can cause DoS against MongoDB Server
A user authorized to perform database queries may cause denial of service by issuing speci...
Affects:
MongoDB Server
versions:
4.4 affects versions prior to 4.4.0-rc7
4.2 affects versions prior to 4.2.8
4.0 affects versions prior to 4.0.19
Reference Link →
05/13/2020
CVE-2019-2388
5.8
Potential exposure of log information in Ops Manager
In affected Ops Manager versions there is an exposed http route was that may allow attacke...
Affects:
Ops Manager
versions:
4.0.9
4.0.10
4.1.5
Reference Link →
05/06/2020
CVE-2020-7921
4.6
Administrative action may disable enforcement of per-user IP whitelisting
Improper serialization of internal state in the authorization subsystem in MongoDB Server'...
Affects:
MongoDB Server
versions:
4.2 affects versions prior to 4.2.3
4.0 affects versions prior to 4.0.15
3.6 affects versions prior to 3.6.18
4.3 affects versions prior to 4.3.3
Reference Link →
04/09/2020
CVE-2020-7922
6.4
Kubernetes Operator generates potentially insecure certificates
X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an at...
Affects:
MongoDB Enterprise Kubernetes Operator
versions:
1.0
1.1
1.2 affects 1.2.4 and prior versions
1.3 affects 1.3.1 and prior versions
1.4 affects 1.4.4 and prior versions
Reference Link →
03/31/2020
CVE-2019-2391
4.2
JS-bson may incorrectly serialise some requests
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BS...
Affects:
js-bson
versions:
1.0 affects 1.1.3 and prior versions
Reference Link →
08/30/2019
CVE-2019-2389
5.3
Process termination via PID file manipulation
Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow ...
Affects:
MongoDB Server
versions:
4.0 affects versions prior to 4.0.11
3.6 affects versions prior to 3.6.14
3.4 affects versions prior to 3.4.22
Reference Link →
08/30/2019
CVE-2019-2390
8.2
Code execution on Windows via OpenSSL engine injection
An unprivileged user or program on Microsoft Windows which can create OpenSSL configuratio...
Affects:
MongoDB Server
versions:
4.0 affects versions prior to 4.0.11
3.6 affects versions prior to 3.6.14
3.4 affects versions prior to 3.4.22
Reference Link →
08/06/2019
CVE-2019-2386
7.1
Authorization session conflation
After user deletion in MongoDB Server the improper invalidation of authorization sessions ...
Affects:
MongoDB Server
versions:
4.0 affects versions prior to 4.0.9
3.6 affects versions prior to 3.6.13
3.4 affects versions prior to 3.4.22
Reference Link →
General
01/24/2024
MongoDB Security Notice
MongoDB has published MongoDB has published a Post Event Summary at the Reference link, be...
Reference Link →
01/04/2024
MongoDB Security Notice
Our investigation of the security incident first reported here on December 16, 2023, US Ea...
01/03/2024
MongoDB Security Notice
Our investigation of the security incident first reported here on December 16, 2023, US Ea...
12/29/2023
MongoDB Security Notice
We continue to find no evidence of unauthorized access to MongoDB Atlas clusters or the At...
12/28/2023
MongoDB Security Notice
At this time, we have found no evidence of unauthorized access to MongoDB Atlas clusters. ...
12/26/2023
MongoDB Security Notice
We are experiencing a spike in login attempts resulting in issues for customers attempting...
12/16/2023
MongoDB Security Notice
MongoDB is actively investigating a security incident involving unauthorized access to cer...