CVE-2026-13071 is a high-severity use-after-free vulnerability in MongoDB Server that allows an authenticated user with read access to cause the mongod process to terminate. This occurs through certain aggregation expressions that execute server-side JavaScript, due to improper memory handling during document processing. The vulnerability affects specific MongoDB Server versions 7.0, 8.0, 8.2.0, and 8.3.0. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-13073 is a medium severity vulnerability in MongoDB Server version 8.0 where an authenticated user with read-only privileges can cause the mongod process to crash by issuing a specially crafted aggregation command. This leads to a denial of service affecting all connected clients until the server process is restarted. The root cause is an internal engine selection inconsistency triggered by specific aggregation options.
CVE-2026-13075 is a high-severity vulnerability in MongoDB Server versions 8.2.0 and 8.3.0. An authenticated user with the ability to run aggregation queries can cause the mongod process to be terminated by the operating system due to memory pressure triggered via the $rankFusion and $scoreFusion aggregation stages. The issue arises from the server's error-handling path and involves allocation of resources without limits or throttling.
CVE-2026-13076 is a high-severity vulnerability in MongoDB Server 8.3.0 where an authenticated user with write access can cause the mongod process to be terminated by the operating system due to excessive memory consumption. This occurs through a specific data type conversion operation within the aggregation framework, leading to resource exhaustion without limits or throttling.
CVE-2026-13078 is a medium severity vulnerability in MongoDB Server where the server-side MozJS scripting engine registers a module loading hook that allows JavaScript code to read arbitrary files on the host filesystem with the privileges of the mongod process. An authenticated user can exploit this by sending crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process. No official patch or remediation guidance is currently provided.
A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.
MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.
An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS.
Strict-winding polygons are intentionally unsupported for indexing, but the guard that rejects them does not inspect members of a GeometryCollection, allowing the unsafe path to be reached which ends with an ensuing null-pointer dereference.
CVE-2026-9751 is a vulnerability in MongoDB Server where the ldapQueryPassword parameter, when set via the runtime setParameter command, is logged in plain text to the mongod.log file. This exposure of sensitive information in logs can lead to unauthorized disclosure of LDAP passwords. The issue affects MongoDB Server versions 7.0.0, 8.0.0, 8.2.0, and 8.3.0. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.8. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-9750 is a high-severity vulnerability in MongoDB Server that allows an authenticated user to cause the server to crash or return incorrect query results. The issue arises from insufficient separation between user-controlled document fields and internal metadata during query execution, leading to reachable assertions. This affects specific MongoDB Server versions including 7.0.0, 8.0.0, 8.2.0, and 8.3.0.
CVE-2026-9749 is a high-severity vulnerability in MongoDB Server affecting versions 7.0.0, 8.0.0, 8.2.0, and 8.3.0. It arises when an aggregation pipeline uses the internal $exchange stage with key-range partitioning and order-preserving delivery, leading to a reachable assertion due to improper handling of a full per-consumer buffer. This can cause the server to reach a code path where the internal high watermark for a key range is not updated as intended.
CVE-2026-9748 is a high-severity vulnerability in MongoDB Server involving a reachable assertion failure. The issue arises from the $_internalConvertBucketIndexStats stage using PauseExecution incorrectly as a skip signal, which is intended only for internal coordination by $facet. When this stage precedes $facet in a pipeline, it causes an unexpected PauseExecution signal that triggers a hard invariant assertion failure, crashing the mongod process.
CVE-2026-9747 is a high-severity vulnerability in MongoDB Server where adding the parameters fromRouter:true and runtimeConstants.userRoles can cause aggregation operations to crash the server. This is due to a reachable assertion issue classified under CWE-617. The vulnerability affects specific versions of MongoDB Server including 7.0.0, 8.0.0, 8.2.0, and 8.3.0. No official patch or remediation guidance has been provided yet.
CVE-2026-9746 is a high-severity vulnerability in MongoDB Server that causes the server to crash due to a reachable assertion failure when using $changestreams and $_requestReshardingResumeToken with the exchange option. The issue requires the user to be logged in but does not require special privileges. Affected versions include 7.0.0, 8.0.0, 8.2.0, and 8.3.0. There is no confirmed patch or official remediation available at this time.
CVE-2026-9743 is a high-severity vulnerability in MongoDB Server 8.0. It involves a NULL pointer dereference in the aggregation pipeline processing. An authenticated user with permission to run aggregation pipelines can cause the server to crash by issuing a specially crafted aggregation followed by a getMore command on the same cursor, leading to denial of service.
When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.
CVE-2026-9741 is a high-severity vulnerability in MongoDB Server affecting versions 7.0.0, 8.0.0, 8.2.0, and 8.3.0. The issue arises in the query analysis of the $vectorSearch aggregation stage when used with Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE). Literal values for encrypted fields within the $vectorSearch filter expressions are transmitted to the server in plaintext rather than ciphertext, exposing sensitive information during transmission.
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).