MongoDB Server vulnerabilities

Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released when an internal aggregation stage is combined with a batch size of 0. Query results returned to the client may contain unrelated data from the server process, and the server process may also terminate unexpectedly.

MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

CVE-2026-8336 allows an authenticated user to crash the mongod server by improperly using server-side JavaScript functions. The issue affects MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog.

A race condition in the document value layer of MongoDB Server allows concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user with ordinary read-write privileges on a database can trigger this condition over the normal client protocol.

An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of service affecting all databases served by the affected node.

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an internal command parameter that can be set by external clients, causing a security check to be improperly skipped.

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.

A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session with monitoring-level permissions and results in exposure of cleartext credentials that could enable impersonation of other users, including privileged accounts.

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface.

A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster. Manual intervention is required to restore service availability.

Improper handling of case sensitivity in MongoDB's configuration validation component may leave the authorization subsystem disabled by default during startup. An unauthenticated user with network access can perform arbitrary administrative operations, fully impacting data confidentiality, integrity, and availability.

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable through diagnostic query statistics output.

A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the metadata is subsequently read by diagnostic operations. The corrupted metadata persists across server restarts and is replicated to other cluster members, requiring manual operator intervention to restore service.

A security issue in MongoDB Server allows an unauthenticated network user to cause denial of service on a specific type of replica set member. An assertion in read concern processing can be triggered without authentication, and its assumptions do not hold for all configurations, crashing the server process.

A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently dereferenced during cursor cleanup, leading to a server process crash.

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writes to arbitrary internal storage tables. The authorization check for these operations validates only the operation's namespace, not the actual storage target, enabling writes to unrelated internal metadata or other collections' data.

A use-after-free vulnerability exists in MongoDB's query execution memory tracking. An authenticated user with read privileges can trigger a write to freed heap memory via standard commands, causing a crash or memory corruption. No user interaction is required.

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries without proper sanitization, causing them to be interpreted as query operators rather than literal equality values. This could result in change stream consumers receiving incorrect post-image documents or encountering non-resumable fatal errors.

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key generation code path. In certain build configurations, this assertion failure results in termination of the mongod process, causing a denial of service to all connected clients.

In MongoDB's LDAP authorization integration, pooled LDAP connections may retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may run under an unintended LDAP identity, leading to incorrect role assignments and potential privilege escalation beyond the intended policy.

MongoDB Server has an issue in Queryable Encryption maintenance operations that could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.

MongoDB Server has an issue in the query execution engine that could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query results.

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.

A vulnerability in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to execute controlled code within the query scope of other users via a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.

A vulnerability in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.

A vulnerability in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.

A vulnerability in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.

A vulnerability in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.

A vulnerability in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intended to disable.

An authenticated user with limited database-scoped privileges can modify diagnostic logging settings affecting the entire server, not just the intended database. This could allow suppression of server-wide diagnostic logging, potentially hiding unauthorized activity or causing excessive log volume that degrades operational monitoring.

An authenticated user with read privileges can cause the MongoDB server process to terminate unexpectedly by submitting a specially formed query filter, resulting in a denial of service.

An authenticated user with write privileges can cause a use-after-free condition through concurrent operations on a collection with a certain validator type, leading to a server crash and denial of service.

An authenticated user with read-level privileges can cause the MongoDB server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index, resulting in a denial of service affecting connected clients and in-flight operations.

An authenticated user with a limited database-scoped role can perform actions against protected system collections that should require more specific privileges, potentially exposing collection metadata and, in certain configurations, allowing unauthorized modification of system collection data.

MongoDB Server has an issue in the aggregation framework that could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.

An authenticated user with specific non-default privileges can perform data-definition operations, such as dropping or modifying collections, on collections they do not have permission to manipulate, due to an inconsistency in target collection determination between authorization check and actual operation.

An authenticated user with write access can cause the MongoDB server process to terminate unexpectedly through handling of certain query predicates against time-series collections with a metaField, resulting in a denial of service.

A vulnerability in MongoDB Server's geospatial query processing allows an authenticated user with write privileges to store malformed geometry data that is later processed without proper validation. This can lead to out-of-bounds memory access, causing a server crash (denial of service) and potentially exposing a limited amount of server process memory.

A vulnerability in MongoDB Server's handling of timeseries collections allows an authenticated user with write privileges to cause internal data structure inconsistency through specific document insertions. Subsequent inserts into the affected bucket can lead to out-of-bounds memory access, potentially causing a server crash, memory exposure, or memory corruption.

A vulnerability in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write privileges to trigger a use-after-free condition. Subsequent operations could result in a server crash or potentially execution of unintended code.

A vulnerability in MongoDB Server's intra-cluster connection setup allows a party with suitable network access to influence the authentication mechanism used between replica set members. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing its recovery. If recovered, the credential could be used to authenticate as the internal superuser.

A vulnerability in MongoDB Server allows an authenticated user with a limited database-scoped role to perform actions on protected system collections that their privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.

A vulnerability in MongoDB Server's aggregation framework allows an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents.

MongoDB Server improperly validates request parameters for a Queryable Encryption maintenance operation against the collection's encrypted field configuration. An authenticated user with readWrite privileges can send a specially crafted request causing a server crash or excessive internal writes, leading to resource exhaustion and corruption of encrypted index data.

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registers a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who can run server-side JavaScript may cause the server to access memory that has already been freed.