MongoDB MongoDB Server
95 CVEs affecting MongoDB MongoDB Server. Latest disclosed: 2026-10-13. Critical: 0, High: 24.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18692 | High | 8.8 | 2026-08-11 | An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to… |
CVE-2026-18691 | High | 8.8 | 2026-08-11 | An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is use… |
CVE-2026-82071 | High | 8.1 | 2026-09-08 | Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted paramete… |
CVE-2026-82067 | High | 8.1 | 2026-09-08 | Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default… |
CVE-2026-82061 | High | 8.1 | 2026-09-08 | A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a writ… |
CVE-2026-82053 | High | 8.1 | 2026-09-08 | A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authent… |
CVE-2026-18712 | High | 8.1 | 2026-08-11 | An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause… |
CVE-2026-18690 | High | 8.1 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that… |
CVE-2026-13072 | High | 8.1 | 2026-07-22 | When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing ca… |
CVE-2026-13059 | High | 8.1 | 2026-07-22 | An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due… |
CVE-2026-9753 | High | 8.1 | 2026-06-09 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bou… |
CVE-2026-13078 | High | 7.7 | 2026-07-22 | A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables Jav… |
CVE-2026-18693 | High | 7.6 | 2026-08-11 | An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to… |
CVE-2026-89099 | High | 7.5 | 2026-09-11 | A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronizati… |
CVE-2026-82075 | High | 7.5 | 2026-09-08 | An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network acce… |
CVE-2026-82064 | High | 7.5 | 2026-09-08 | A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server con… |
CVE-2026-18697 | High | 7.5 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitt… |
CVE-2026-9742 | High | 7.5 | 2026-06-09 | When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to s… |
CVE-2026-9740 | High | 7.5 | 2026-06-09 | A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. Th… |
CVE-2026-18711 | High | 7.1 | 2026-08-11 | An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used… |