MongoDB NoSQL Database

Known Exploited MongoDB Vulnerabilities

The following MongoDB vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 106 vulnerabilities in MongoDB with an average score of 6.5 out of ten. Last year, in 2025 MongoDB had 23 security vulnerabilities published. That is, 83 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.09.

Recent MongoDB Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-19003	Aug 12, 2026	MongoDB BI Connector ODBC Driver Buffer Overflow in Setup Dialog A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running the dialog.	C Driver
CVE-2026-19004	Aug 12, 2026	MongoDB BI Connector ODBC Driver Mem Leak via Proc Outp Meta An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.	C Driver
CVE-2026-18888	Aug 12, 2026	MongoDB BI Connector ODBC Driver Buffer Overflow in Float to Text Conversion The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.	C Driver
CVE-2026-19001	Aug 12, 2026	MongoDB BI Connector ODBC Buf Overflow Metaretrieval The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.	C Driver
CVE-2026-19002	Aug 12, 2026	Out-of-Bounds Write in MongoDB BI Connector ODBC Driver A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.	C Driver
CVE-2026-19503	Aug 12, 2026	MongoDB Schema Manager & Atlas ODBC Driver OIDC Scheme Validation Flaw MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.	C Driver
CVE-2026-19502	Aug 12, 2026	MongoDB SQL Schema Builder CLI Auth Data Exposed in stdout & logs MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.
CVE-2026-18710	Aug 11, 2026	MongoDB Driver logs credential in cleartext A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.	MongoDB
CVE-2026-18712	Aug 11, 2026	MongoDB Queryable Encryption Privilege Escalation via Metadata Validation An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.	MongoDB
CVE-2026-18711	Aug 11, 2026	MongoDB Server: Authenticated Use-After-Free in Time-Series Queries An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query results.	MongoDB
CVE-2026-18709	Aug 11, 2026	MongoDB: Authenticated User Bypasses Transaction Coordination An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.	MongoDB
CVE-2026-18698	Aug 11, 2026	MongoDB Privilege Escalation: System Collection Access Abuse An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations, unauthorized modification of system collection data.	MongoDB
CVE-2026-18690	Aug 11, 2026	MongoDB Server Privileges Escalate: Dropping System Collections An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.	MongoDB
CVE-2026-18699	Aug 11, 2026	MongoDB Server Query Planner DoS via Text Index An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connected clients and in-flight operations.	MongoDB
CVE-2026-18691	Aug 11, 2026	MongoDB Server Intra-Cluster Auth Mechanism Manipulation (CVE-2026-18691) An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deployment.	MongoDB
CVE-2026-18702	Aug 11, 2026	MongoDB Server diag log config privilege escalation to serverwide logging An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitoring by causing excessive log volume.	MongoDB
CVE-2026-18694	Aug 11, 2026	MongoDB Auth Write Privilege Exploits Malformed Geo OOB Access and DOS An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memory outside its intended bounds. This could result in a server crash (denial of service) and may expose a limited amount of server process memory.	MongoDB
CVE-2026-18708	Aug 11, 2026	MongoDB JS Exec in Query Scope by Authenticated Users An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.	MongoDB
CVE-2026-18696	Aug 11, 2026	MongoDB applyOps Auth Escalation via Collection Targeting Inconsistency An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual operation.	MongoDB
CVE-2026-18700	Aug 11, 2026	MongoDB Geospatial Validator UAF DoS An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service.	MongoDB
CVE-2026-18701	Aug 11, 2026	MongoDB Crash via Crafted Query Filter (Auth Read) An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.	MongoDB
CVE-2026-18697	Aug 11, 2026	MongoDB Server: Aggregation Framework Crash (DoS) An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.	MongoDB
CVE-2026-18693	Aug 11, 2026	MongoDB Server Timeseries Insertion Causes Memory Corruption (CVE-2026-18693) An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.	MongoDB
CVE-2026-18705	Aug 11, 2026	MongoDB Atlas Vector Search View Escalation (Read Access Bypass) An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.	MongoDB
CVE-2026-18704	Aug 11, 2026	MongoDB Server: Aggregation Stage Enables Write Ops w/ Read Auth An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.	MongoDB
CVE-2026-18692	Aug 11, 2026	Privileged Write Use-After-Free in MongoDB TimeSeries Bucket Lifecycle An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.	MongoDB
CVE-2026-18688	Aug 11, 2026	MongoDB Server OOB Memory Read via Aggregation Stage An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents.	MongoDB
CVE-2026-18695	Aug 11, 2026	MongoDB Time-series Query Predicate DoS via metaField An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service.	MongoDB
CVE-2026-18687	Aug 11, 2026	MongoDB Queryable Encryption Parameter Validation Failure Crash MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data.	MongoDB
CVE-2026-18706	Aug 11, 2026	Auth UAF & Crash via $graphLookup Stage in MongoDB Server An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.	MongoDB
CVE-2026-18707	Aug 11, 2026	MongoDB Server: Auth-Only User Can Trigger Denial via Aggregation An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.	MongoDB
CVE-2026-18703	Aug 11, 2026	MongoDB Server Auth Bypass via Cert Despite Disabled Method An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intended to disable.	MongoDB
CVE-2026-14881	Jul 22, 2026	CVE-2026-14881: Compass import allows global OIDC browser override When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.	Compass
CVE-2026-13055	Jul 22, 2026	AuthAllowed Aggregation Crash (CVE202613055) in MongoDB The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.	MongoDB
CVE-2026-13056	Jul 22, 2026	MongoDB OOM via Large Array Query Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.	MongoDB
CVE-2026-13057	Jul 22, 2026	MongoDB Atlas Search Auth Bypass via $search routing An issue in the servers Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due to insufficient input validation, an authenticated client can supply these fields directly.	MongoDB
CVE-2026-13058	Jul 22, 2026	MongoDB mongod Crash via Incomplete Transaction Command (DoS) An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.	MongoDB
CVE-2026-13059	Jul 22, 2026	Insecure Query-Level RBAC in MongoDB - Unauthorized Data Access An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.	MongoDB
CVE-2026-9737	Jul 22, 2026	MongoDB Sort Pattern Processing Flaw (CVE-2026-9737) During query planning when reading the sort pattern in raw BSONObj form, in some places we dont explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.	MongoDB
CVE-2026-13060	Jul 22, 2026	MongoDB Auth Bypass via $graphLookup in View Pipelines An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.	MongoDB
CVE-2026-13061	Jul 22, 2026	MongoDB Authenticated Session Metadata Disclosure via $listSessions An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.	MongoDB
CVE-2026-13062	Jul 22, 2026	MongoDB Queryable Encryption Metadata Bypass in Sharded mongos An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.	MongoDB
CVE-2026-13063	Jul 22, 2026	Out-of-Memory Vulnerability in MongoDB libmongocrypt Causes mongod Crash An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively large memory allocation.	MongoDB
CVE-2026-13064	Jul 22, 2026	MongoDB CPU Exhaustion via Deeply Nested $jsonSchema Queries Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.	MongoDB
CVE-2026-13065	Jul 22, 2026	Read-Only User Exploits $linearFill Crash in MongoDB (DoS) A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.	MongoDB
CVE-2026-13066	Jul 22, 2026	MongoDB Improper DBPointer JSON Serialization Can Leak Internal Memory Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.	MongoDB
CVE-2026-13067	Jul 22, 2026	MongoDB X509 Role Bypass via PROXY v2 on Unix Socket When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.	MongoDB
CVE-2026-13068	Jul 22, 2026	MongoDB Auth Bypass: Unauthorized Cursor Termination Across DB An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace.	MongoDB
CVE-2026-13069	Jul 22, 2026	MongoDB QE Resource Exhaustion (CVE-2026-13069) An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.	MongoDB
CVE-2026-13070	Jul 22, 2026	MongoDB TLS Crash via Malformed OCSP Response A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificate authority, or for the connection to traverse an untrusted network path.	MongoDB