Threat Intelligence Database

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.

Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices. This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6

Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

CVE-2026-8053 is a high-severity vulnerability in MongoDB Server's time-series collection implementation. It allows an authenticated user with database write privileges to cause an out-of-bounds memory write in the mongod process due to an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. This flaw can lead to arbitrary code execution under certain conditions. The vulnerability affects multiple MongoDB Server versions prior to 5.0.33, 6.0.28, 7.0.34, 8.

Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Server v8.1 versions, MongoDB Server v8.0 versions prior to 8.0.21, MongoDB Server v7.0 versions prior to 7.0.32

CVE-2026-4148 is a high-severity use-after-free vulnerability in MongoDB Server versions 7.0, 8.0, and 8.2. It can be exploited by an authenticated user with read role privileges in sharded clusters by issuing a specially crafted $lookup or $graphLookup aggregation pipeline. This vulnerability does not require user interaction or elevated privileges beyond read access but can lead to high impact on confidentiality, integrity, and availability. No known exploits are currently reported in the wild. The vulnerability stems from improper memory management (CWE-416) during aggregation operations in sharded environments. Organizations using affected MongoDB versions in sharded configurations should prioritize patching or mitigating this issue to prevent potential exploitation. The CVSS 4.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+8#cve#cve-2026-4148#cwe-416

Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems. Additionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. This vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2

MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2025-12893#cwe-295

CVE-2025-6711 is a vulnerability in MongoDB Server where sensitive information from unredacted queries may be logged in server logs under certain error conditions. This affects MongoDB Server versions 6.0 prior to 6.0.21, 7.0 prior to 7.0.18, and 8.0 prior to 8.0.5. The vulnerability has a medium severity with a CVSS score of 4.4. It does not involve integrity or availability impacts but can lead to confidentiality breaches due to sensitive data exposure in logs.