SB2026081848 - Multiple vulnerabilities in MongoDB Server

Security Bulletin ID SB2026081848

CSH Severity

Medium

Patch available

YES

Number of vulnerabilities 23

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 23 vulnerabilities.

1) Type Confusion (CVE-ID: CVE-2026-18701)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to access of resource using incompatible type in the query subsystem when processing a specially formed query filter. A remote user can submit a specially formed query filter to cause a denial of service.

The issue can cause the server process to terminate unexpectedly.

2) Incorrect authorization (CVE-ID: CVE-2026-18712)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify or destroy data in a different collection.

The vulnerability exists due to improper authorization in Queryable Encryption maintenance operations when processing internal metadata references for operations on other namespaces. A remote user can manipulate certain metadata references to modify or destroy data in a different collection.

Exploitation requires privileges on one encrypted collection.

3) Use-after-free (CVE-ID: CVE-2026-18711)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to use-after-free in the query execution engine when running certain queries against time-series collections. A remote user can run crafted queries to cause a denial of service or disclose sensitive information.

Exploitation requires read and write privileges on the affected database.

4) Missing Authorization (CVE-ID: CVE-2026-18709)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.9 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause cross-shard data inconsistency, corrupt the cluster clock, and violate transaction atomicity guarantees.

The vulnerability exists due to missing authorization in sharded transaction commit/abort handling when handling commit or abort operations for an in-progress prepared transaction on a shard. A remote user can send commit or abort operations directly to a shard to cause cross-shard data inconsistency, corrupt the cluster clock, and violate transaction atomicity guarantees.

Exploitation requires direct network access to a shard.

5) Incorrect authorization (CVE-ID: CVE-2026-18690)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform unauthorized actions on protected system collections.

The vulnerability exists due to improper authorization in protected system collections when handling actions from users with limited database-scoped roles. A remote user can perform actions against protected system collections to perform unauthorized actions on protected system collections.

This could result in critical system collections being dropped and recreated without proper authorization.

6) NULL pointer dereference (CVE-ID: CVE-2026-18699)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to null pointer dereference in MongoDB Server query planner when processing a specially formed query against a collection with a text index. A remote user can submit a specially formed query to cause a denial of service.

The server process may terminate unexpectedly, affecting connected clients and in-flight operations.

7) Algorithm Downgrade (CVE-ID: CVE-2026-18691)

CWE-ID: CWE-757 - Selection of Less-Secure Algorithm During Negotiat

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and authenticate as the internal superuser to nodes in the deployment.

The vulnerability exists due to selection of less-secure algorithm during negotiation in intra-cluster connection setup when one replica set member connects to another. A remote attacker can influence which authentication mechanism is used to disclose sensitive information and authenticate as the internal superuser to nodes in the deployment.

Exploitation requires suitable network access and occurs only under certain conditions where the cluster's shared internal credential is transmitted in a less-protected form and can be recovered.

8) Improper privilege management (CVE-ID: CVE-2026-18702)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify server-wide diagnostic logging settings.

The vulnerability exists due to improper privilege management in the profile command when handling requests to change diagnostic logging settings. A remote user can issue a crafted profile command to modify server-wide diagnostic logging settings.

This may suppress diagnostic logging across the server or cause excessive log volume that degrades operational monitoring.

9) Out-of-bounds read (CVE-ID: CVE-2026-18694)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service and disclose limited process memory.

The vulnerability exists due to out-of-bounds read in MongoDB Server geospatial query processing when handling subsequent queries against stored malformed geometry data. A remote user can store specially crafted geometry data to cause a denial of service and disclose limited process memory.

Exploitation requires write privileges to store malformed geometry data before it is later queried.

10) Code Injection (CVE-ID: CVE-2026-18708)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute code within the query scope of other users.

The vulnerability exists due to improper control of code generation in MongoDB Server's JavaScript scripting engine when processing a specially crafted stored value during an internal maintenance cycle. A remote user can store a specially crafted value to execute code within the query scope of other users.

Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.

11) Incorrect authorization (CVE-ID: CVE-2026-18696)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform unauthorized data-definition operations on collections.

The vulnerability exists due to improper authorization in the applyOps command when processing applyOps operations on collections. A remote privileged user can submit a crafted applyOps command to perform unauthorized data-definition operations on collections.

The issue is caused by an inconsistency between the collection used for the authorization check and the collection targeted by the actual operation.

12) Use-after-free (CVE-ID: CVE-2026-18700)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in MongoDB Server geospatial validation when processing concurrent operations against a collection using a certain type of validator. A remote user can perform concurrent write operations to cause a denial of service.

The issue can trigger a server crash.

13) Incorrect authorization (CVE-ID: CVE-2026-18703)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass authentication mechanism restrictions.

The vulnerability exists due to improper enforcement of authentication mechanism restrictions in MongoDB Server authentication handling when processing certificate-based authentication requests. A remote user can authenticate with a valid client certificate and a corresponding user account to bypass authentication mechanism restrictions.

Exploitation requires a valid client certificate and a corresponding user account, and occurs even when the server is configured to restrict authentication to other mechanisms.

14) Reachable assertion (CVE-ID: CVE-2026-18697)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to reachable assertion in MongoDB Server aggregation framework on mongos when processing a specially formed aggregation command. A remote attacker can submit a specially formed aggregation command to cause a denial of service.

The issue causes the mongos router process to terminate unexpectedly, disrupting client connections routed through the affected instance.

15) Out-of-bounds write (CVE-ID: CVE-2026-18693)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service or disclose limited memory contents.

The vulnerability exists due to out-of-bounds write in MongoDB Server timeseries bucket handling when processing certain document insertions into timeseries collections. A remote user can insert crafted documents to cause a denial of service or disclose limited memory contents.

Exploitation requires write privileges on timeseries collections, and the issue is triggered by a subsequent insert into the affected bucket after the internal data structure becomes inconsistent.

16) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-18705)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to reliance on untrusted inputs in a security decision in Atlas Vector Search when constructing an internal request forwarded to the search process. A remote user can supply crafted fields to retrieve documents from a different protected view to disclose sensitive information.

Exploitation requires read access to one view, and the exposed data comes from another protected view over the same underlying collection.

17) Missing Authorization (CVE-ID: CVE-2026-18704)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform unauthorized write operations.

The vulnerability exists due to improper authorization in the aggregation framework when processing externally supplied aggregation pipelines that invoke an internal-use aggregation stage. A remote user can send a specially crafted aggregation request to perform unauthorized write operations.

The issue affects embedded operations within an internal-use aggregation stage that is reachable by external clients.

18) Use-after-free (CVE-ID: CVE-2026-18692)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute unintended code or cause a denial of service.

The vulnerability exists due to use-after-free in timeseries bucket lifecycle handling when processing write operations. A remote user can trigger use of an internal reference after the underlying memory has been freed to execute unintended code or cause a denial of service.

19) Out-of-bounds read (CVE-ID: CVE-2026-18688)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service and disclose limited memory contents.

The vulnerability exists due to out-of-bounds read in the aggregation framework when processing a specially formed numeric parameter in a certain aggregation pipeline stage. A remote user can provide a specially formed numeric parameter to cause a denial of service and disclose limited memory contents.

20) Reachable assertion (CVE-ID: CVE-2026-18695)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to reachable assertion in timeseries query processing when handling certain query predicates against time-series collections with a metaField. A remote user can send crafted query predicates to cause a denial of service.

Exploitation requires write access.

21) Integer underflow (CVE-ID: CVE-2026-18687)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service and corrupt encrypted index data.

The vulnerability exists due to integer underflow in the Queryable Encryption maintenance operation when processing specially formed request parameters against the collection's encrypted field configuration. A remote user can submit a specially formed request to cause a denial of service and corrupt encrypted index data.

The issue can lead to excessive internal writes, resulting in resource exhaustion.

22) Use-after-free (CVE-ID: CVE-2026-18706)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute unintended code or cause a denial of service.

The vulnerability exists due to use-after-free in the $graphLookup aggregation stage when processing aggregation and memory-management commands. A remote privileged user can issue crafted aggregation and memory-management commands to execute unintended code or cause a denial of service.

23) Reachable assertion (CVE-ID: CVE-2026-18707)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to reachable assertion in aggregation command handling when processing a specially formed aggregation command. A remote user can submit a specially formed aggregation command to cause a denial of service.

The issue can cause the server process to terminate unexpectedly.

Remediation

Install update from vendor's website.

SB2026081848 - Multiple vulnerabilities in MongoDB Server

Breakdown by Severity

Description

Remediation

References

Please verify you're human