MongoDB NoSQL Database

Known Exploited MongoDB Vulnerabilities

The following MongoDB vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 74 vulnerabilities in MongoDB with an average score of 6.3 out of ten. Last year, in 2025 MongoDB had 23 security vulnerabilities published. That is, 51 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.11

Recent MongoDB Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-14881	Jul 22, 2026	CVE-2026-14881: Compass import allows global OIDC browser override When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.	Compass
CVE-2026-13055	Jul 22, 2026	AuthAllowed Aggregation Crash (CVE202613055) in MongoDB The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.	MongoDB
CVE-2026-13056	Jul 22, 2026	MongoDB OOM via Large Array Query Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.	MongoDB
CVE-2026-13057	Jul 22, 2026	MongoDB Atlas Search Auth Bypass via $search routing An issue in the servers Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due to insufficient input validation, an authenticated client can supply these fields directly.	MongoDB
CVE-2026-13058	Jul 22, 2026	MongoDB mongod Crash via Incomplete Transaction Command (DoS) An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.	MongoDB
CVE-2026-13059	Jul 22, 2026	Insecure Query-Level RBAC in MongoDB - Unauthorized Data Access An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.	MongoDB
CVE-2026-9737	Jul 22, 2026	MongoDB Sort Pattern Processing Flaw (CVE-2026-9737) During query planning when reading the sort pattern in raw BSONObj form, in some places we dont explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.	MongoDB
CVE-2026-13060	Jul 22, 2026	MongoDB Auth Bypass via $graphLookup in View Pipelines An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.	MongoDB
CVE-2026-13061	Jul 22, 2026	MongoDB Authenticated Session Metadata Disclosure via $listSessions An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated usernames, and activity timestamps.	MongoDB
CVE-2026-13062	Jul 22, 2026	MongoDB Queryable Encryption Metadata Bypass in Sharded mongos An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.	MongoDB
CVE-2026-13063	Jul 22, 2026	Out-of-Memory Vulnerability in MongoDB libmongocrypt Causes mongod Crash An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively large memory allocation.	MongoDB
CVE-2026-13064	Jul 22, 2026	MongoDB CPU Exhaustion via Deeply Nested $jsonSchema Queries Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.	MongoDB
CVE-2026-13065	Jul 22, 2026	Read-Only User Exploits $linearFill Crash in MongoDB (DoS) A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.	MongoDB
CVE-2026-13066	Jul 22, 2026	MongoDB Improper DBPointer JSON Serialization Can Leak Internal Memory Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.	MongoDB
CVE-2026-13067	Jul 22, 2026	MongoDB X509 Role Bypass via PROXY v2 on Unix Socket When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.	MongoDB
CVE-2026-13068	Jul 22, 2026	MongoDB Auth Bypass: Unauthorized Cursor Termination Across DB An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace.	MongoDB
CVE-2026-13069	Jul 22, 2026	MongoDB QE Resource Exhaustion (CVE-2026-13069) An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.	MongoDB
CVE-2026-13070	Jul 22, 2026	MongoDB TLS Crash via Malformed OCSP Response A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificate authority, or for the connection to traverse an untrusted network path.	MongoDB
CVE-2026-13071	Jul 22, 2026	MongoDB Process Kill via JS Aggregation An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.	MongoDB
CVE-2026-13072	Jul 22, 2026	Memory Corruption via Aggregation Pipeline in MongoDB Compute Mode When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.	MongoDB
CVE-2026-13073	Jul 22, 2026	MongoDB: ReadOnly User Can Crash mongod via Aggregation An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency triggered by a specific combination of aggregation options.	MongoDB
CVE-2026-13074	Jul 22, 2026	MongoDB Awaitable Hello CPU DoS via Exhaust Mode An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability.	MongoDB
CVE-2026-13075	Jul 22, 2026	Auth User Triggers OOM via $rankFusion/$scoreFusion in MongoDB An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.	MongoDB
CVE-2026-13076	Jul 22, 2026	Authenticated MongoDB Aggregation Bug Causes OS Termination An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and requires both write access to the database and the ability to run aggregation queries.	MongoDB
CVE-2026-13077	Jul 22, 2026	MongoDB OOB Heap Read via Malformed BSON CodeWScope A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.	MongoDB
CVE-2026-13078	Jul 22, 2026	MongoDB Server: MozJS Script Engine Allows Unrestricted File Access A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.	MongoDB
CVE-2026-11933	Jun 12, 2026	MongoDB JavaScript Engine UAF via BSON-to-Array A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process memory or a denial of service through a server crash.	MongoDB
CVE-2026-9740	Jun 09, 2026	MongoDB BSON Validator Recursion Crash (CVE20269740) A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.	MongoDB
CVE-2026-9735	Jun 09, 2026	MongoDB Server Exposes Auth Credentials in Logs During SASL Auth MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.	MongoDB
CVE-2026-9754	Jun 09, 2026	MongoDB filemd5 LE: Authenticated Read Role Stack Memory Leak An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command	MongoDB
CVE-2026-9753	Jun 09, 2026	MongoDB $_internalApplyOplogUpdate OOBB via malformed oplog diff The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.	MongoDB
CVE-2026-9752	Jun 09, 2026	MongoDB 2dsphere Crash via GeometryCollection NPE in GeoJSON An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-winding polygons are intentionally unsupported for indexing, but the guard that rejects them does not inspect members of a GeometryCollection, allowing the unsafe path to be reached which ends with an ensuing null-pointer dereference.	MongoDB
CVE-2026-9751	Jun 09, 2026	Plain Text Password Logging via ldapQueryPassword in MongoDB The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.	MongoDB
CVE-2026-9750	Jun 09, 2026	MongoDB Internal Metadata Injection Crash Vulnerability An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document fields and internal metadata in certain execution paths.	MongoDB
CVE-2026-9749	Jun 09, 2026	MongoDB $exchange Stage Buffer Update Failure Enables DoS This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer (that is, many results are routed to the same consumer), the server reaches the code path where a full per-consumer buffer is detected but the internal "high watermark" for that key range is not updated as intended.	MongoDB
CVE-2026-9748	Jun 09, 2026	MongoDB $facet Crash via PauseExecution misuse in aggregation pipeline The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.	MongoDB
CVE-2026-9747	Jun 09, 2026	MongoDB Crash via fromRouter:true and userRoles Aggregation Bug Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.	MongoDB
CVE-2026-9746	Jun 09, 2026	MongoDB Crash via $_requestReshardingResumeToken (Change Streams) When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user must be logged in to issue the statement.	MongoDB
CVE-2026-9743	Jun 09, 2026	MongoDB 8.0 Aggregation Null _subPipeline Causing DoS In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.	MongoDB
CVE-2026-9742	Jun 09, 2026	MongoDB OIDC Pre-Auth DoS via 'mechanism' param When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.	MongoDB
CVE-2026-9741	Jun 09, 2026	MongoDB QE $vectorSearch Stage Plaintext Leak A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.	MongoDB
CVE-2026-9101	May 20, 2026	MongoDB Compass: CSV import prototype pollution leads to 1click exec Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.	Compass
CVE-2026-9100	May 20, 2026	MongoDB C Driver GridFS API divisionzero via malformed metadata The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).	C Driver
CVE-2026-8843	May 18, 2026	MongoDB 7.0 (pre-7.0.32) | 2dsphere_bucket Index Crash on Non-TS Buckets Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices. This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6	MongoDB
CVE-2026-6811	May 14, 2026	MongoDB PHP Driver Stack Exhaustion from Deeply Nested BSON Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
CVE-2026-8202	May 13, 2026	DoS via $trim/$ltrim/$rtrim in MongoDB 7.0-8.3 (pre 7.0.34, 8.0.23, 8.2.9, 8.3.2) Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.	MongoDB
CVE-2026-8336	May 13, 2026	MongoDB Server <7.0.34/8.0.23/8.2.9/8.3.2: Auth DoS via _internalJsEmit After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce commands map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service. This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.	MongoDB
CVE-2026-8201	May 13, 2026	Use-After-Free in MongoDB mongocryptd FLE query (v7.0<7.0.34/8.0<8.0.23) A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue impacts MongoDB Servers mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.	MongoDB
CVE-2026-8200	May 13, 2026	MongoDB Server 7.0 log message data leak via schema validation prior to 7.0.34 When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted.  This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.	MongoDB
CVE-2026-8199	May 13, 2026	MongoDB Server OOM via Bitwise Expr AST (7.0.33,8.0.22,8.2.8,8.3.1) An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.	MongoDB