CVE-2026-13074 is a medium-severity vulnerability in MongoDB Server that allows an unauthenticated remote client to cause excessive CPU consumption. This occurs by sending a specific combination of parameters to the awaitable hello command in exhaust mode, which triggers a response loop bypassing normal throttling. This can degrade server availability with only a small number of connections. No official patch or remediation guidance is currently available.
When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.
When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.
CVE-2026-13055 is a high-severity vulnerability in MongoDB Server affecting versions 7.0, 8.0, 8.2.0, and 8.3.0. It involves the `$_internalIndexKey` aggregation expression, which any authenticated user can use to crash the MongoDB server by triggering an internal assertion failure. This occurs due to improper handling of compound wildcard index specifications during aggregation pipeline execution.
CVE-2026-13056 is a high-severity vulnerability in MongoDB Server where crafted queries using expressions that generate large arrays can cause the server to allocate excessively large intermediate objects in memory. This can lead to an out-of-memory (OOM) crash of the server. The issue affects MongoDB Server versions 8.0 and 8.3.0. There is no confirmed patch or official remediation available at this time.
CVE-2026-13057 is a medium severity vulnerability in MongoDB Server's Atlas Search integration. It allows an authenticated user to bypass per-user access controls in sharded topologies by exploiting insufficient input validation in the $search and $searchMeta aggregation stages. These stages use internal routing fields normally set only by trusted routers during sharded search planning, but the vulnerability permits clients to supply these fields directly.
CVE-2026-13058 is a high-severity vulnerability in MongoDB Server where an authenticated user with basic write privileges can cause the mongod process to crash by sending a crafted transaction command missing required fields. This leads to a denial of service due to an internal assertion failure caused by inconsistent validation of transaction command parameters.
An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.
CVE-2026-9737 is a high-severity vulnerability in MongoDB Server involving a reachable assertion failure during query planning. The issue arises when the server reads the sort pattern in raw BSONObj form and does not properly handle the meta expression case, potentially causing an invariant failure. This vulnerability affects specific MongoDB Server versions 7.0, 8.0, 8.2.0, and 8.3.0. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.
CVE-2026-13061 is a medium-severity vulnerability in MongoDB Server where an authenticated user can view session metadata of other users via the $listSessions aggregation stage. This metadata, normally restricted to cluster-level administrators, includes active session IDs, usernames, and activity timestamps. The vulnerability affects MongoDB Server versions 7.0, 8.0, and 8.3.0. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.
CVE-2026-13063 is a medium severity vulnerability in MongoDB Server versions 8.2.0 and 8.3.0. An authenticated user with standard read/write privileges can trigger an integer overflow or wraparound in the libmongocrypt library by sending a crafted aggregation command. This causes the mongod process to terminate due to an out-of-memory condition from an excessively large memory allocation.
CVE-2026-13064 is a high-severity vulnerability in MongoDB Server where certain query operations using deeply nested $jsonSchema constructs cause excessive CPU consumption. This can lead to resource exhaustion, and the CPU-bound operation cannot be interrupted by standard administrative controls. The affected versions include 8.0, 8.2.0, and 8.3.0. No official patch or remediation has been confirmed yet.
CVE-2026-13065 is a high-severity vulnerability in MongoDB Server where a user with read-only privileges can cause the mongod process to crash by crafting an aggregation pipeline using the $linearFill window function with a specific sortBy expression. This leads to a NULL pointer dereference and results in a denial of service. The issue arises from insufficient validation of sort specifications during execution.
CVE-2026-13066 is a high-severity vulnerability in MongoDB Server involving improper handling of DBPointer objects during BSON serialization in the server-side JavaScript engine. This flaw can cause internal process memory contents to be unintentionally included in data returned to clients, leading to information disclosure. The issue affects deployments that use server-side JavaScript. No official patch or remediation guidance is currently provided by the vendor.
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.
CVE-2026-13068 is an authorization vulnerability in MongoDB Server where an authenticated user with cursor termination privileges on one database may improperly terminate active cursors on another database. This occurs due to an authorization check that does not correctly limit privileges to the intended database namespace, potentially disrupting query operations for other users. The vulnerability affects multiple MongoDB Server versions including 7.0, 8.0, 8.2.0, and 8.3.0. The severity is rated low with a CVSS score of 2.3. No official patch or remediation guidance has been provided yet.
CVE-2026-13069 is a high-severity vulnerability in MongoDB Server where an authenticated user can trigger excessive CPU usage or out-of-memory conditions by sending a specially crafted Queryable Encryption find payload. This payload contains an unvalidated field that controls an internal computation loop, leading to resource exhaustion and degraded availability for other operations. The vulnerability affects multiple versions of MongoDB Server including 7.0, 8.0, 8.2.0, and 8.3.0. No official patch or remediation guidance is currently available from the vendor.
A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificate authority, or for the connection to traverse an untrusted network path.