SB2026081854 - Multiple vulnerabilities in MongoDB Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081854

SB2026081854 - Multiple vulnerabilities in MongoDB Server

Published: August 18, 2026

Security Bulletin ID SB2026081854
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 13
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 23% Low 77%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 13 vulnerabilities.


1) Cleartext transmission of sensitive information (CVE-ID: CVE-2026-9741)

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to cleartext transmission of sensitive information in the query analysis processing of the $vectorSearch aggregation stage when handling filter expressions for encrypted fields. A remote user can submit a query containing literal values for encrypted fields to disclose sensitive information.

This affects Queryable Encryption (QE) and Client-Side Field Level Encryption (CSFLE).


2) Improper Validation of Specified Type of Input (CVE-ID: CVE-2026-9742)

CWE-ID: CWE-1287 - Improper Validation of Specified Type of Input

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of specified type of input in the authenticate command when processing the "mechanism" parameter. A remote attacker can send a specially crafted authenticate command to cause a denial of service.

Only configurations with OIDC authentication enabled are vulnerable.


3) NULL pointer dereference (CVE-ID: CVE-2026-9743)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the aggregation sub-pipeline handling logic when processing a specially crafted aggregation pipeline followed by getMore on the same cursor. A remote user can issue a specially crafted aggregation followed by getMore to cause a denial of service.

Exploitation requires the ability to run aggregation pipelines.


4) Reachable assertion (CVE-ID: CVE-2026-9746)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a reachable assertion in exchange option handling when using $changestreams and $_requestReshardingResumeToken with the exchange option. A remote user can issue a crafted statement to cause a denial of service.

The user must be logged in to issue the statement.


5) Reachable assertion (CVE-ID: CVE-2026-9747)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to reachable assertion in cross-shard merge aggregation handling when processing aggregation options with fromRouter:true and runtimeConstants.userRoles. A remote user can send a specially crafted aggregation request to cause a denial of service.


6) Reachable assertion (CVE-ID: CVE-2026-9748)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to reachable assertion in $_internalConvertBucketIndexStats and TeeBuffer when processing an aggregation pipeline that places $_internalConvertBucketIndexStats before $facet. A remote user can send a specially crafted request to cause a denial of service.

The issue is triggered when index stats conversion fails and the stage propagates an unexpected PauseExecution signal upstream to $facet coordination logic.


7) Reachable assertion (CVE-ID: CVE-2026-9749)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to reachable assertion in the internal $exchange stage when running an aggregation pipeline using key-range partitioning and order-preserving delivery. A remote user can run a crafted aggregation pipeline to cause a denial of service.

Exploitation requires a single key range to produce enough documents to fill its exchange buffer so that many results are routed to the same consumer.


8) Reachable assertion (CVE-ID: CVE-2026-9750)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service or return incorrect results.

The vulnerability exists due to reachable assertion in internal metadata processing during query execution when creating documents with $-prefixed fields that interfere with internal metadata. A remote user can create crafted documents to cause a denial of service or return incorrect results.


9) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-9751)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in the ldapQueryPassword runtime setParameter handling when setting the ldapQueryPassword parameter through the runtime setParameter command. A local user can set the ldapQueryPassword parameter to cause the password to be written to mongod.log in plain text to disclose sensitive information.


10) NULL pointer dereference (CVE-ID: CVE-2026-9752)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in 2dsphere index key generation when running a query on a field storing a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. A remote user can run a crafted query to cause a denial of service.

Strict-winding polygons are intentionally unsupported for indexing, but members of a GeometryCollection are not properly rejected before the unsafe path is reached.


11) Improper Validation of Specified Type of Input (CVE-ID: CVE-2026-9753)

CWE-ID: CWE-1287 - Improper Validation of Specified Type of Input

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to improper validation of specified type of input in the $_internalApplyOplogUpdate aggregation pipeline stage when processing a document diff containing a malformed binary diff. A remote user can execute the stage with a crafted document diff to disclose sensitive information and cause a denial of service.

The stage can be executed by a user with access to the aggregate command.


12) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-9735)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in MongoDB Server logging during SASL authentication when connection health metric logging is enabled. A local user can trigger SASL authentication to disclose sensitive information.

The full authentication parameters may be written to the server log without redaction.


13) Uncontrolled Recursion (CVE-ID: CVE-2026-9740)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in BSON validation logic when parsing specially crafted messages containing certain nested binary data structures. A remote attacker can send a specially crafted message to cause a denial of service.

The issue can crash the mongod process because mutual recursion between validation functions resets internal depth tracking.


Remediation

Install update from vendor's website.

References