The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.
CVE-2026-96746 is a high-severity vulnerability in the MongoDB C Driver involving an out-of-bounds write in the connection-monitoring logic. An unauthenticated attacker who can control DNS resolution and responses for hosts in a client's connection string may exploit this to write beyond the end of a heap buffer, potentially causing the application to crash unexpectedly.
CVE-2026-96745 is a medium severity vulnerability in the MongoDB PHP Driver involving deserialization of untrusted data in the command monitoring feature. An unauthenticated attacker who controls data included in a database operation can cause the driver to instantiate application classes implementing the driver's persistable interface, invoking their unserialization methods with attacker-supplied data. The impact depends on the classes present in the application. This vulnerability affects multiple version ranges of the MongoDB PHP Driver prior to fixed versions 1.21.10, 2.1.10, and 2.5.3.
MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.
Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations.
Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.
Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.
CVE-2026-93761 is a high-severity vulnerability in the Mongoid library by MongoDB Inc. It involves inefficient regular expression complexity in the in-memory query evaluation component. An unauthenticated attacker can supply crafted text in a pattern-matching query on embedded associations, causing excessive processing and potentially making the application unresponsive. This affects multiple Mongoid versions from 7.2.0 through 9.1.0 as specified. No known exploits are reported in the wild, and no patch information is provided in the source data.
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.
A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the database can then read values that were intended to be protected from that party. This may result in unintended disclosure of sensitive information.
Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.
Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field update. This may result in unintended removal of stored records and in the embedding application becoming unresponsive.
An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.
CVE-2026-93395 is an integer underflow vulnerability in the bson_new_from_buffer() function of the MongoDB C Driver. The function fails to validate that the BSON document length is at least 5 bytes, allowing a zero-length prefix to cause an integer wraparound. This leads to a heap out-of-bounds read and a process crash, resulting in a denial of service. The vulnerability affects versions from 2.0.0 up to but not including 2.3.1. No known exploits are reported in the wild. The CVSS 4.0 score is 6.9, indicating a medium severity.
CVE-2026-93394 is a vulnerability in MongoDB Inc.'s C Driver (libmongoc) affecting versions from 2.0.0 up to but not including 2.3.2. The flaw lies in the SCRAM authentication implementation, where the client proceeds with the authentication handshake and sends the client proof even if a nonce mismatch is detected in the server's first message. This could allow a man-in-the-middle attacker to inject a crafted server message and capture the client proof, potentially enabling offline password cracking. The vulnerability is mitigated by the use of TLS, which is standard in production environments.
CVE-2026-93393 is a critical heap-based buffer overflow vulnerability in the TLS transport layer of the MongoDB C Driver when built with the Windows TLS backend. A remote endpoint can trigger out-of-bounds writes during processing of encrypted traffic after the TLS handshake, without requiring authentication or user interaction. This can cause memory corruption, disclosure of adjacent heap memory, or process termination.
Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.
If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys.
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.
CVE-2026-89099 is a race condition vulnerability in MongoDB Server's document value layer that allows concurrent threads to access the same internal memory without proper synchronization. An authenticated user with normal read-write privileges can exploit this to cause server termination and potential memory corruption. This may affect the confidentiality, integrity, and availability of the server process.