MongoDB Server vulnerabilities

CVE-2026-8336 allows an authenticated user to crash the mongod server by improperly using server-side JavaScript functions. The issue affects MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog.

MongoDB Server has an issue in Queryable Encryption maintenance operations that could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.

MongoDB Server has an issue in the query execution engine that could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query results.

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.

A vulnerability in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to execute controlled code within the query scope of other users via a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.

A vulnerability in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.

A vulnerability in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.

A vulnerability in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.

A vulnerability in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.

A vulnerability in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intended to disable.

An authenticated user with limited database-scoped privileges can modify diagnostic logging settings affecting the entire server, not just the intended database. This could allow suppression of server-wide diagnostic logging, potentially hiding unauthorized activity or causing excessive log volume that degrades operational monitoring.

An authenticated user with read privileges can cause the MongoDB server process to terminate unexpectedly by submitting a specially formed query filter, resulting in a denial of service.

An authenticated user with write privileges can cause a use-after-free condition through concurrent operations on a collection with a certain validator type, leading to a server crash and denial of service.

An authenticated user with read-level privileges can cause the MongoDB server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index, resulting in a denial of service affecting connected clients and in-flight operations.

An authenticated user with a limited database-scoped role can perform actions against protected system collections that should require more specific privileges, potentially exposing collection metadata and, in certain configurations, allowing unauthorized modification of system collection data.

MongoDB Server has an issue in the aggregation framework that could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.

An authenticated user with specific non-default privileges can perform data-definition operations, such as dropping or modifying collections, on collections they do not have permission to manipulate, due to an inconsistency in target collection determination between authorization check and actual operation.

An authenticated user with write access can cause the MongoDB server process to terminate unexpectedly through handling of certain query predicates against time-series collections with a metaField, resulting in a denial of service.

A vulnerability in MongoDB Server's geospatial query processing allows an authenticated user with write privileges to store malformed geometry data that is later processed without proper validation. This can lead to out-of-bounds memory access, causing a server crash (denial of service) and potentially exposing a limited amount of server process memory.

A vulnerability in MongoDB Server's handling of timeseries collections allows an authenticated user with write privileges to cause internal data structure inconsistency through specific document insertions. Subsequent inserts into the affected bucket can lead to out-of-bounds memory access, potentially causing a server crash, memory exposure, or memory corruption.

A vulnerability in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write privileges to trigger a use-after-free condition. Subsequent operations could result in a server crash or potentially execution of unintended code.

A vulnerability in MongoDB Server's intra-cluster connection setup allows a party with suitable network access to influence the authentication mechanism used between replica set members. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing its recovery. If recovered, the credential could be used to authenticate as the internal superuser.

A vulnerability in MongoDB Server allows an authenticated user with a limited database-scoped role to perform actions on protected system collections that their privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.

A vulnerability in MongoDB Server's aggregation framework allows an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents.

MongoDB Server improperly validates request parameters for a Queryable Encryption maintenance operation against the collection's encrypted field configuration. An authenticated user with readWrite privileges can send a specially crafted request causing a server crash or excessive internal writes, leading to resource exhaustion and corruption of encrypted index data.

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registers a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who can run server-side JavaScript may cause the server to access memory that has already been freed.

In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.

A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator mishandles nested binary data structures, leading to uncontrolled mutual recursion between validation functions.