MongoDB vulnerabilities
383 CVEs and advisories name MongoDB as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-13055Server crash via aggregation pipeline expression with compound wildcard index specification
- CVE-2026-13056A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM
- CVE-2026-13057Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META
- CVE-2026-13058Transaction Command Insufficient Input Validation Leading to Process Termination
- CVE-2026-13059Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass
- CVE-2026-9737Find command with $meta sort can lead to crash
- CVE-2026-13060$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access
- CVE-2026-13061Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage
- CVE-2026-13062MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters
- CVE-2026-13063libmongocrypt Improper Input Validation Leading to Process Termination
- CVE-2026-13064MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service
- CVE-2026-13065MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination
- CVE-2026-13066Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure
- CVE-2026-13067tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket
- CVE-2026-13068MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse
- CVE-2026-13069Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion
- CVE-2026-13070Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination
- CVE-2026-13071Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination
- CVE-2026-13072MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption
- CVE-2026-13073MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination
- CVE-2026-13074Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service
- CVE-2026-13075$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation
- CVE-2026-13076Aggregation Framework Memory Exhaustion Leading to Process Termination
- CVE-2026-13077Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data
- CVE-2026-13078Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
- CVE-2026-11933Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion
- CVE-2026-9740Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow
- CVE-2026-9735Keyfile contents are in MongoDB Server logs
- CVE-2026-9754Stack memory disclosure in filemd5 command
- CVE-2026-9753Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.