CVE-2026-81528 is a medium severity vulnerability in the MongoDB C# Driver version 2.9.0. The issue arises because the document-replacement code path does not validate element names or shapes as strictly as other write paths, allowing untrusted, loosely-typed input to be interpreted as update logic rather than data. This can lead to unintended execution of database commands under the application's credentials. Applications using strongly-typed document mappings are not affected.
CVE-2026-81527 is a medium severity vulnerability in the MongoDB C# Driver version 2.14.0. It involves improper neutralization of special elements in data query logic within the LINQ-to-aggregation query translation layer. This flaw allows application-supplied values to be interpreted as query logic rather than data, potentially altering query results or causing unintended data to be returned.
CVE-2026-81526 is a high-severity vulnerability in the MongoDB Rust Driver version 3.0.0 where special characters in a caller-supplied target identifier are not properly neutralized before being sent to the server. This flaw allows an attacker who can control the target identifier to cause write operations to affect unintended targets within the same deployment, potentially modifying data across logical boundaries enforced by the application.
CVE-2026-81522 is a high-severity vulnerability in the MongoDB C++ Driver version 3.0.0. It involves improper encoding or escaping of output related to namespace identifiers constructed from untrusted input. This flaw can allow an attacker to manipulate namespace identifiers with special characters, potentially causing operations to target unintended data. The impact includes limited unauthorized read and write access to data belonging to other logical tenants within the affected application.
CVE-2026-75573 is a medium severity vulnerability in MongoDB Connector for BI version 2.12.0 where the mongodrdl tool may write a TLS private-key password to standard error if the password is supplied both via the connection URI and command-line option. This disclosure could allow a local user with access to the command output and encrypted key file to obtain the password and access the TLS client key.
CVE-2026-75159 is a high-severity vulnerability in MongoDB BI Connector version 2.4.0. An unauthenticated client can cause the mongosqld process to terminate by triggering a double free error during a crafted Kerberos GSSAPI authentication exchange. This results in a denial of service by interrupting BI Connector availability until the process restarts.
A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running the dialog.
An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.
The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.
The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.
A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.
An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query results.
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations, unauthorized modification of system collection data.
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.