SB2026081846 - Multiple vulnerabilities in MongoDB Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081846

SB2026081846 - Multiple vulnerabilities in MongoDB Server

Published: August 18, 2026

Security Bulletin ID SB2026081846
CSH Severity
High
Patch available
YES
Number of vulnerabilities 22
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 5% Medium 14% Low 82%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 22 vulnerabilities.


1) Incorrect authorization (CVE-ID: CVE-2026-13067)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to obtain unintended role assignments.

The vulnerability exists due to incorrect authorization in tlsCATrusts role validation on the Unix domain socket path when using PROXY protocol v2 with MONGODB-X509 authentication. A local user can connect through the proxy Unix domain socket with a valid X.509 certificate issued by a trusted certificate authority to obtain unintended role assignments.

Exploitation requires local access to the proxy Unix domain socket.


2) Reachable assertion (CVE-ID: CVE-2026-13058)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to reachable assertion in transaction command handling when processing a crafted transaction command with an incomplete set of required fields. A remote user can send a crafted transaction command to cause a denial of service.

The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure.


3) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-13059)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass role-based access controls to perform unauthorized reads and writes.

The vulnerability exists due to reliance on untrusted inputs in a security decision in find, update, delete, and aggregate commands when processing certain client-supplied command parameters. A remote user can send crafted command parameters to bypass role-based query-level access controls to perform unauthorized reads and writes.

Only non-apiStrict configurations are vulnerable.


4) Reachable assertion (CVE-ID: CVE-2026-9737)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to reachable assertion in query planning logic for raw BSON sort pattern handling when processing a find command with a $meta sort expression. A remote user can send a specially crafted query to cause a denial of service.


5) Incorrect authorization (CVE-ID: CVE-2026-13060)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to incorrect authorization in the $graphLookup aggregation stage when evaluating authorization and execution for collections referenced within existing view pipeline definitions. A remote user can query a view that references unauthorized collections to disclose sensitive information.

Only affected scenarios involving collections referenced within existing view pipeline definitions are exposed.


6) Incorrect authorization (CVE-ID: CVE-2026-13061)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the $listSessions aggregation stage when handling aggregation requests. A remote user can query session metadata for other users to disclose sensitive information.

The disclosed data includes active session identifiers, associated usernames, and activity timestamps.


7) Unintended Proxy or Intermediary (CVE-ID: CVE-2026-13062)

CWE-ID: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to corrupt encrypted query correctness.

The vulnerability exists due to unintentional proxy or intermediary behavior in mongos when processing crafted write commands for Queryable Encryption-enabled collections on a sharded cluster. A remote user can send crafted write commands to corrupt encrypted query correctness.

The issue affects internal encryption metadata fields that are intended to be server-controlled.


8) Integer overflow (CVE-ID: CVE-2026-13063)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to integer overflow or wraparound in libmongocrypt when processing a crafted aggregation command. A remote user can send a crafted aggregation command to cause a denial of service.

The issue can trigger an out-of-memory condition in the mongod process through excessively large memory allocation.


9) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-13064)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in the $jsonSchema query operator when processing deeply nested $jsonSchema constructs. A remote user can send a specially crafted query to cause a denial of service.

The resulting CPU-bound operation cannot be interrupted through standard administrative controls.


10) NULL pointer dereference (CVE-ID: CVE-2026-13065)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in the $linearFill window function operator when processing an aggregation pipeline with a specific sortBy expression type. A remote user can craft a specially crafted aggregation pipeline to cause a denial of service.

The issue affects the mongod process during execution of sort specifications.


11) Type Confusion (CVE-ID: CVE-2026-13066)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to type confusion in DBPointer BSON serialization in MongoDB's server-side JavaScript engine when processing DBPointer objects during BSON serialization. A remote user can trigger serialization of crafted DBPointer objects to disclose sensitive information.

Only deployments that use server-side JavaScript are affected.


12) Missing Authorization (CVE-ID: CVE-2026-13078)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in the MozJS scripting engine module loader when processing crafted aggregation pipeline commands. A remote user can submit crafted aggregation pipeline commands containing JavaScript to read sensitive files accessible to the MongoDB server process to disclose sensitive information.

The issue allows access to files from the host filesystem using the mongod process's privileges.


13) Incorrect authorization (CVE-ID: CVE-2026-13068)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to terminate active cursors on a separate database and disrupt ongoing query operations.

The vulnerability exists due to improper access control in mongos cursor termination authorization checks when handling cursor termination requests. A remote user can send a cursor termination request for active cursors on another database to terminate active cursors on a separate database and disrupt ongoing query operations.

The issue results from privileges not being correctly scoped to the appropriate namespace.


14) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-13069)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the Queryable Encryption FLE2 find payload handling when processing a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. A remote user can send a crafted Queryable Encryption find payload to cause a denial of service.

The issue can result in excessive CPU consumption or out-of-memory conditions, degrading availability for other operations.


15) NULL pointer dereference (CVE-ID: CVE-2026-13070)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to null pointer dereference in OCSP response processing during the outbound TLS handshake when handling a malformed OCSP response from a remote peer. A remote attacker can send a malformed OCSP response to cause a denial of service.

OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificate authority, or for the connection to traverse an untrusted network path.


16) Use-after-free (CVE-ID: CVE-2026-13071)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in server-side JavaScript aggregation expressions when processing aggregation expressions that execute server-side JavaScript during document processing. A remote user can send specially crafted aggregation expressions to cause a denial of service.

The issue can terminate the mongod process and requires read access.


17) Heap-based buffer overflow (CVE-ID: CVE-2026-13072)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to improper input validation in aggregation pipeline processing when processing externally sourced BSON data in compute mode on a standalone mongod instance. A remote attacker can send specially crafted BSON data to cause memory corruption.

This issue is exposed only when compute mode is explicitly enabled on a standalone mongod instance.


18) Reachable assertion (CVE-ID: CVE-2026-13073)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to reachable assertion in aggregation command processing when handling a crafted aggregation command with a specific combination of aggregation options. A remote user can send a crafted aggregation command to cause a denial of service.

The mongod process terminates abnormally, affecting all connected clients until the process is restarted.


19) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-13074)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the awaitable hello command in exhaust mode when handling a specific combination of parameters. A remote attacker can send crafted command parameters to cause a denial of service.

A small number of connections can degrade server availability by triggering excessive CPU consumption.


20) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-13075)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the server error-handling path for the $rankFusion and $scoreFusion aggregation stages when generating error suggestions during aggregation query processing. A remote user can send crafted aggregation queries to cause a denial of service.

Exploitation requires the ability to run aggregation queries, and the mongod process may be terminated by the operating system under memory pressure.


21) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-13076)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in MongoDB's aggregation framework when performing a specific data type conversion operation. A remote user can run a crafted aggregation query to cause a denial of service.

Exploitation requires write access to the database and the ability to run aggregation queries.


22) Out-of-bounds read (CVE-ID: CVE-2026-13077)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the BSON CodeWScope element accessors when processing a crafted aggregation pipeline containing malformed BSONColumn data. A remote user can generate malformed BSONColumn data containing a CodeWScope element to cause a denial of service or disclose sensitive information.

The forged element bypasses wire-level BSON validation, and exploitation occurs when the element is decompressed and an unchecked size value is used in pointer arithmetic.


Remediation

Install update from vendor's website.

References