CVE-2026-18687
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
MongoDB Server improperly validates request parameters for a Queryable Encryption maintenance operation against the collection's encrypted field configuration. An authenticated user with readWrite privileges can send a specially crafted request causing a server crash or excessive internal writes, leading to resource exhaustion and corruption of encrypted index data.
Risk Assessment
The attack can cause denial of service (DoS) and corruption of encrypted index data, potentially affecting data integrity and availability in MongoDB.
Recommendation
Apply the patches provided by MongoDB immediately and restrict readWrite privileges to trusted users only.
Original NVD description (English source)
MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data.