MongoDB
308 CVEs across 58 MongoDB products. Browse MongoDB vulnerabilities, severities, and proof-of-concept exploits.
MongoDB products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-96749 | High | 8.4 | 2026-09-24 | An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built f… |
CVE-2026-96748 | Medium | 6.5 | 2026-09-24 | PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an applica… |
CVE-2026-96747 | Medium | 5.0 | 2026-09-24 | The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain… |
CVE-2026-96750 | High | 7.1 | 2026-09-24 | MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that dat… |
CVE-2026-96746 | Medium | 6.5 | 2026-09-24 | An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the respo… |
CVE-2026-96745 | Medium | 5.6 | 2026-09-24 | Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored… |
CVE-2026-96744 | High | 7.1 | 2026-09-24 | Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supp… |
CVE-2026-93764 | Medium | 6.5 | 2026-09-18 | Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enabl… |
CVE-2026-93763 | Medium | 6.5 | 2026-09-18 | A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-sid… |
CVE-2026-93762 | Critical | 9.8 | 2026-09-18 | Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to c… |
CVE-2026-93761 | High | 7.5 | 2026-09-18 | An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cau… |
CVE-2026-93760 | High | 8.2 | 2026-09-18 | Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In… |
CVE-2026-93759 | High | 8.6 | 2026-09-18 | Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript exp… |
CVE-2026-93765 | Critical | 9.1 | 2026-09-18 | Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from… |
CVE-2026-93758 | High | 8.1 | 2026-09-18 | An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges… |
CVE-2026-93395 | Medium | 5.3 | 2026-09-17 | A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length pre… |
CVE-2026-93394 | Low | 3.7 | 2026-09-17 | A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a… |
CVE-2026-92758 | Medium | 5.5 | 2026-09-17 | If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwo… |
CVE-2026-92757 | Medium | 5.5 | 2026-09-17 | Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encrypt… |
CVE-2026-92756 | Medium | 5.5 | 2026-09-17 | Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently… |
CVE-2026-89099 | High | 7.5 | 2026-09-11 | A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronizati… |
CVE-2026-88036 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file ide… |
CVE-2026-88035 | Medium | 4.7 | 2026-09-10 | A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past… |
CVE-2026-88034 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file i… |
CVE-2026-88033 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file… |
CVE-2026-88032 | Medium | 5.9 | 2026-09-10 | A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted… |
CVE-2026-88031 | High | 8.1 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file id… |
CVE-2026-88030 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file… |
CVE-2026-88029 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured fil… |
CVE-2026-88028 | Medium | 6.5 | 2026-09-10 | Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-… |
CVE-2026-88026 | Medium | 6.5 | 2026-09-10 | Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied chara… |
CVE-2026-88025 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file id… |
CVE-2026-88024 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file… |
CVE-2026-88023 | High | 8.3 | 2026-09-10 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file… |
CVE-2026-82076 | Medium | 6.5 | 2026-09-08 | An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to byp… |
CVE-2026-82075 | High | 7.5 | 2026-09-08 | An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network acce… |
CVE-2026-82074 | Medium | 6.5 | 2026-09-08 | MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specia… |
CVE-2026-82073 | Medium | 6.5 | 2026-09-08 | A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization check… |
CVE-2026-82071 | High | 8.1 | 2026-09-08 | Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted paramete… |
CVE-2026-82070 | Medium | 6.5 | 2026-09-08 | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected… |
CVE-2026-82069 | Low | 2.7 | 2026-09-08 | A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query tex… |
CVE-2026-82068 | Medium | 6.5 | 2026-09-08 | A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafte… |
CVE-2026-82067 | High | 8.1 | 2026-09-08 | Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default… |
CVE-2026-82066 | Medium | 4.3 | 2026-09-08 | A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privilege… |
CVE-2026-82065 | Medium | 6.5 | 2026-09-08 | A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persisten… |
CVE-2026-82064 | High | 7.5 | 2026-09-08 | A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server con… |
CVE-2026-82063 | Medium | 5.3 | 2026-09-08 | A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific… |
CVE-2026-82062 | Medium | 5.5 | 2026-09-08 | A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by… |
CVE-2026-82061 | High | 8.1 | 2026-09-08 | A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a writ… |
CVE-2026-82060 | Medium | 5.4 | 2026-09-08 | In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operat… |
CVE-2026-82059 | Medium | 5.3 | 2026-09-08 | An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to interna… |
CVE-2026-82058 | Medium | 6.5 | 2026-09-08 | A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON… |
CVE-2026-82057 | Medium | 6.5 | 2026-09-08 | A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom… |
CVE-2026-82056 | Medium | 5.3 | 2026-09-08 | A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent i… |
CVE-2026-82055 | Medium | 6.5 | 2026-09-08 | A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted Ge… |
CVE-2026-82054 | Medium | 6.5 | 2026-09-08 | A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially craft… |
CVE-2026-82053 | High | 8.1 | 2026-09-08 | A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authent… |
CVE-2026-82052 | Medium | 6.5 | 2026-09-08 | The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain spe… |
CVE-2026-84968 | Medium | 5.3 | 2026-09-03 | An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a… |
CVE-2026-84967 | Medium | 4.3 | 2026-09-03 | A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a co… |
CVE-2026-84966 | Medium | 5.1 | 2026-09-03 | An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly… |
CVE-2026-84965 | Medium | 5.1 | 2026-09-03 | An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operat… |
CVE-2026-84964 | Medium | 5.9 | 2026-09-03 | A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already tr… |
CVE-2026-84963 | Medium | 5.3 | 2026-09-03 | An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently sho… |
CVE-2026-84962 | Medium | 4.2 | 2026-09-03 | An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorize… |
CVE-2026-84971 | Medium | 6.5 | 2026-09-03 | Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the… |
CVE-2026-84970 | Medium | 6.2 | 2026-09-03 | A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding a… |
CVE-2026-84969 | Low | 3.7 | 2026-09-03 | A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a b… |
CVE-2026-81533 | High | 7.1 | 2026-08-28 | An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of… |
CVE-2026-81532 | High | 8.8 | 2026-08-28 | A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exce… |
CVE-2026-81520 | High | 7.5 | 2026-08-28 | A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-base… |
CVE-2026-81518 | High | 7.5 | 2026-08-28 | When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require… |
CVE-2026-81517 | High | 7.5 | 2026-08-28 | An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhau… |
CVE-2026-81490 | High | 7.7 | 2026-08-28 | A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by definin… |
CVE-2026-77586 | High | 8.0 | 2026-08-28 | In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by… |
CVE-2026-77184 | Medium | 5.2 | 2026-08-28 | In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CRE… |
CVE-2026-76798 | Medium | 6.3 | 2026-08-28 | The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them f… |
CVE-2026-76797 | Medium | 6.3 | 2026-08-28 | The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreads… |
CVE-2026-76794 | Medium | 4.6 | 2026-08-28 | MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can i… |
CVE-2026-81530 | Medium | 5.6 | 2026-08-27 | A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the app… |
CVE-2026-81529 | High | 7.1 | 2026-08-27 | Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes un… |
CVE-2026-81527 | Medium | 6.5 | 2026-08-27 | A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and qu… |
CVE-2026-81526 | Medium | 6.5 | 2026-08-27 | The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server… |
CVE-2026-81525 | High | 8.1 | 2026-08-27 | The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct… |
CVE-2026-81524 | Medium | 5.4 | 2026-08-27 | A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the dri… |
CVE-2026-81523 | Medium | 4.4 | 2026-08-27 | A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted with… |
CVE-2026-81522 | High | 8.1 | 2026-08-27 | A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An applicatio… |
CVE-2026-81521 | Medium | 6.5 | 2026-08-27 | The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping… |
CVE-2026-75573 | Medium | 4.4 | 2026-08-27 | In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and… |
CVE-2026-75159 | Medium | 5.9 | 2026-08-27 | An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a… |
CVE-2026-19003 | High | 7.8 | 2026-08-12 | A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of… |
CVE-2026-19503 | Medium | 4.8 | 2026-08-12 | MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's disco… |
CVE-2026-19502 | Medium | 5.5 | 2026-08-12 | MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connectio… |
CVE-2026-19004 | High | 8.1 | 2026-08-12 | An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Trigg… |
CVE-2026-19002 | High | 8.1 | 2026-08-12 | A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the cli… |
CVE-2026-19001 | Critical | 9.8 | 2026-08-12 | The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or obj… |
CVE-2026-18888 | Medium | 6.5 | 2026-08-12 | The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When… |
CVE-2026-18710 | Medium | 6.5 | 2026-08-11 | A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log o… |
CVE-2026-18712 | High | 8.1 | 2026-08-11 | An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause… |
CVE-2026-18711 | High | 7.1 | 2026-08-11 | An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used… |