MongoDB vulnerabilities
383 CVEs and advisories name MongoDB as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-120819Use-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulator
- CVE-2026-118383Pre-authentication use-after-free in MongoDB Server replica set primary catch-up
- CVE-2026-120828Memory exhaustion via abandoned far-future read-concern waiters in disaggregated storage
- CVE-2026-120826Improper Authorization in MongoDB Server Sharded View Definition Handling Leads to Cross-Database Unauthorized Access
- CVE-2026-120825Improper Authorization in MongoDB Server Aggregation Framework View Definition Validation Leads to Unauthorized Collection Access
- CVE-2026-120824Post-authentication use-after-free in MongoDB Server time-series bucket validation
- CVE-2026-120823Missing Authorization Check in MongoDB Server Aggregation Framework Leads to Unauthorized Access to Deployment-Wide Configuration Data
- CVE-2026-120822Missing Authorization Check in MongoDB Server Replication-Related Administrative Command Leads to Unauthorized Data Access
- CVE-2026-120821Post-authentication use-after-free in MongoDB Server aggregation sub-pipelines
- CVE-2026-120820Uncontrolled Resource Consumption in MongoDB Server Per-Namespace Encrypted-Field Statistics Table Leads to Denial of Service
- CVE-2026-120818Use-After-Free in MongoDB Server JavaScript Support for Aggregation Leads to Information Disclosure
- CVE-2026-120817Post-authentication race condition in MongoDB Server geospatial schema validation
- CVE-2026-120816System collection contents readable through a database change stream with showSystemEvents
- CVE-2026-120815Incorrect Authorization Check in MongoDB Server Localhost Exception Leads to Unauthorized Administrative Access
- CVE-2026-120814MultiUpdateCoordinator state replay lets a shard administrator create a persistent cluster root user
- CVE-2026-120813Plaintext storage of encrypted fields via duplicate keys in client-side encryption schema parsing
- CVE-2026-120812Full server crash via unbounded per-operand recursion in time-series query vectorization
- CVE-2026-120811Use-After-Free in MongoDB Server Classic Query Engine Plan Cache Leads to Information Disclosure and Denial of Service
- CVE-2026-120810Uncontrolled Resource Consumption in MongoDB Server Aggregation Framework via Internal Expression Leads to Denial of Service
- CVE-2026-120809Heap use-after-free read via yield-time state save in time-series block unpacking
- CVE-2026-120808Certificate Validation Bypass via IPv6 trust-result skip in macOS TLS client
- CVE-2026-120807Privilege escalation via fail-open user lookup in X.509 cluster-membership guard
- CVE-2026-120806Authorization role-graph corruption via no-op cleanup filters in dropAllRolesFromDatabase
- CVE-2026-120805Authorization bypass via redirected FLE2 state-collection writes in encrypted CRUD path
- CVE-2026-120804Credential-handle retention via missing flag set in Windows Kerberos auth handler
- CVE-2026-120803MongoDB SBE $locf Window Accumulator Use-After-Free Enables Heap OOB Read and Server Crash
- CVE-2026-120959MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-array stride, causing out-of-bounds writes
- CVE-2026-120952MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds write
- CVE-2026-120567EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference
- CVE-2026-120953Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler