CVE-2026-18697
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
MongoDB Server has an issue in the aggregation framework that could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.
Risk Assessment
An unauthenticated attacker can cause the mongos router to crash, potentially leading to service unavailability for clients.
Recommendation
Apply patches provided by MongoDB or restrict access to mongos to trusted clients only.
Original NVD description (English source)
An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.