What is CVE-2026-93762?

CVE-2026-93762 is a critical-severity vulnerability in MongoDB Inc. Mongoid, classified under Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection). CVSS score: 9.8/10. Published 2026-09-18.

How severe is CVE-2026-93762?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in MongoDB Inc. Mongoid

CVE-2026-93762

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Mongodb Inc. Mongoid — versions 9.1.0

Weakness classification (CWE)

CWE-470 — Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)

References

cna@mongodb.com

Frequently asked questions

What is CVE-2026-93762?: CVE-2026-93762 is a critical-severity vulnerability in MongoDB Inc. Mongoid, classified under Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection). CVSS score: 9.8/10. Published 2026-09-18.
How severe is CVE-2026-93762?: Critical severity. CVSS v3 base score is 9.8 out of 10.