https://cvebrief.com/archive/cves/vendor/mongodb/ High and critical MongoDB vulnerabilities covered by CVE Brief, with independent analyst commentary. en-us Sun, 20 Sep 2026 12:00:00 GMT https://cvebrief.com/cve/cve-2026-93758/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-93758 Sun, 20 Sep 2026 12:00:00 GMT An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-93760/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-93760 Sun, 20 Sep 2026 12:00:00 GMT Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-93759/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-93759 Sat, 19 Sep 2026 12:00:00 GMT Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-88023/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-88023 Fri, 11 Sep 2026 12:00:00 GMT Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-88024/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-88024 Fri, 11 Sep 2026 12:00:00 GMT Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. Fix documented: 3.9.1 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-88025/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-88025 Fri, 11 Sep 2026 12:00:00 GMT Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-88029/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-88029 Fri, 11 Sep 2026 12:00:00 GMT Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. Fix documented: 4.18.1 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-88030/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-88030 Fri, 11 Sep 2026 12:00:00 GMT Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-88033/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-88033 Fri, 11 Sep 2026 12:00:00 GMT Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. Fix documented: 5.11.1 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-88034/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-88034 Fri, 11 Sep 2026 12:00:00 GMT Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. Fix documented: 4.5.3 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-88036/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-88036 Fri, 11 Sep 2026 12:00:00 GMT Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. Fix documented: 1.30.10 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-77586/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-77586 Sun, 30 Aug 2026 12:00:00 GMT In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. Fix documented: 2.14.31 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-81490/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-81490 Sun, 30 Aug 2026 12:00:00 GMT A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. Fix documented: 2.14.31 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-81517/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-81517 Sun, 30 Aug 2026 12:00:00 GMT An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. Fix documented: 2.14.31 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-81518/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-81518 Sun, 30 Aug 2026 12:00:00 GMT When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. Fix documented: 2.14.31 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-81520/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-81520 Sun, 30 Aug 2026 12:00:00 GMT A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Fix documented: 2.14.31 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-81532/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-81532 Sat, 29 Aug 2026 12:00:00 GMT A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Fix documented: 1.4.10 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-81522/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-81522 Fri, 28 Aug 2026 12:00:00 GMT A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. Fix documented: 4.5.1 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-81525/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-81525 Fri, 28 Aug 2026 12:00:00 GMT The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. Fix documented: 1.21.4 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-19001/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-19001 Thu, 13 Aug 2026 12:00:00 GMT The MongoDB BI Connector ODBC Driver is susceptible to a buffer overflow during metadata retrieval, which may lead to process termination or arbitrary code execution. Fix documented: 1.4.9 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-18691/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-18691 Wed, 12 Aug 2026 12:00:00 GMT An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another Fix documented: 8.3.8 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-18692/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-18692 Wed, 12 Aug 2026 12:00:00 GMT An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed Fix documented: 8.3.8 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-13059/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-13059 Fri, 24 Jul 2026 12:00:00 GMT An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters Fix documented: 7.0.39 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-13072/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-13072 Fri, 24 Jul 2026 12:00:00 GMT When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior Fix documented: 7.0.39 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-13078/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-13078 Fri, 24 Jul 2026 12:00:00 GMT A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges Fix documented: 7.0.39 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-14881/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-14881 Fri, 24 Jul 2026 12:00:00 GMT When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form Fix documented: 1.49.7 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-11933/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-11933 Fri, 12 Jun 2026 12:00:00 GMT A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-8053/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-8053 Thu, 14 May 2026 12:00:00 GMT An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process Fix documented: 5.0.33 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-6691/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-6691 Thu, 07 May 2026 12:00:00 GMT The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-4148/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2026-4148 Wed, 18 Mar 2026 12:00:00 GMT A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline Fix documented: 8.2.6 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-14847/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2025-14847 Sat, 20 Dec 2025 12:00:00 GMT Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client Fix documented: 8.2.3 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-11575/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2025-11575 Thu, 23 Oct 2025 12:00:00 GMT Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-12100/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2025-12100 Thu, 23 Oct 2025 12:00:00 GMT Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-11695/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2025-11695 Mon, 13 Oct 2025 12:00:00 GMT When tlsInsecure=False appears in a connection string, certificate validation is disabled Fix documented: v3.2.5 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-10491/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2025-10491 Mon, 15 Sep 2025 12:00:00 GMT The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking Fix documented: 6.0.25 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-6713/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-mongodb-CVE-2025-6713 Mon, 07 Jul 2025 12:00:00 GMT An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server Fix documented: 6.0.22 (CVE record). Independent analyst report on CVE Brief.