MongoDB vulnerabilities
383 CVEs and advisories name MongoDB as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-9752GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation
- CVE-2026-9751Sensitive data could be written to mongod.log
- CVE-2026-9750Metadata name collision on $-prefixed fields causes post-auth server crash
- CVE-2026-9749Using MaxKey() may crash the server
- CVE-2026-9748$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input
- CVE-2026-9747Crafted cross-shard merge aggregation crashes MongoDB Server
- CVE-2026-9746Server crashes in case of the use of exchange
- CVE-2026-9743Aggregation sub-pipeline null dereference may allow DoS via crafted getMore
- CVE-2026-9742Authenticate command with specific mechanism parameter can trigger server crash
- CVE-2026-9741Client side encryption fails to encrypt values in a $vectorSearch
- CVE-2026-9101Prototype pollution in csv parsing
- CVE-2026-9100Heap memory out of bounds read and crash in C Driver legacy GridFS file reader
- CVE-2026-8843Calling createIndex with certain index types can crash mongod
- CVE-2026-6811PHP Stack Exhaustion
- CVE-2026-8202Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators
- CVE-2026-8336Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands
- CVE-2026-8201Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields
- CVE-2026-8200Schema validation log messages may not redact user data
- CVE-2026-8199Post-auth memory exhaustion via bitwise match expressions
- CVE-2026-8053FlatBSON Duplicate Field Index Drift
- CVE-2026-8431Ops Manager RCE via webhook body
- CVE-2026-8063Post-auth null pointer dereference when aggregating against a view with empty search pipeline
- CVE-2026-6691MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow
- CVE-2026-6915Flaw in the updateUser Command May Allow Unauthorized Configuration Change
- CVE-2026-6914MD5 checksum creation may cause availability loss
- CVE-2026-6231bson_validate may skip validation when processing certain inputs
- CVE-2026-5170Users could trigger a crash of mongod primaries during promotion to sharded
- CVE-2026-4359Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer
- CVE-2026-4358Memory safety issues in slot-based execution hash table spill
- CVE-2026-4148ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators