MongoDB vulnerabilities
383 CVEs and advisories name MongoDB as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-19001MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names
- CVE-2026-19002Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver
- CVE-2026-19503Insufficient OIDC endpoint validation could invoke unintended local protocol handlers
- CVE-2026-19502Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI
- CVE-2026-18710Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization
- CVE-2026-18712Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections
- CVE-2026-18711Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure
- CVE-2026-18709Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency
- CVE-2026-18698Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command
- CVE-2026-18690Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections
- CVE-2026-18699Improper Input Validation in MongoDB Query Planner Leads to Denial of Service
- CVE-2026-18691Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure
- CVE-2026-18702Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings
- CVE-2026-18694Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure
- CVE-2026-18708Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes
- CVE-2026-18696Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections
- CVE-2026-18700Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service
- CVE-2026-18701Type Confusion in MongoDB Query Subsystem Leads to Denial of Service
- CVE-2026-18697Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos
- CVE-2026-18693Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure
- CVE-2026-18705Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data
- CVE-2026-18704Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations
- CVE-2026-18692Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution
- CVE-2026-18688Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure
- CVE-2026-18695Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service
- CVE-2026-18687Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption
- CVE-2026-18706Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution
- CVE-2026-18707Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service
- CVE-2026-18703Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method
- CVE-2026-14881Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow