MongoDB vulnerabilities and fixes

CVEs that mention MongoDB, ranked by priority. 76 tracked.

MongoDB has 76 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 65. Most recent: 2026-10-24. Highest priority: CVE-2026-19001 (score 53/100).

• CVE-2026-19001 CRITICAL 9.8 UPGRADE The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application s
• CVE-2026-75852 CRITICAL 9.8 ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-proto
• CVE-2026-48616 CRITICAL 9.3 UPGRADE Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerab
• CVE-2026-19004 HIGH 8.1 UPGRADE An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing
• CVE-2026-19111 HIGH 8.1 Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon
• CVE-2026-72600 HIGH 7.5 A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers t
• CVE-2026-13072 HIGH 8.1 UPGRADE When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BS
• CVE-2026-18692 HIGH 8.8 UPGRADE DOWNGRADE An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with wr
• CVE-2026-19002 HIGH 8.1 UPGRADE A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Drive
• CVE-2026-18697 HIGH 7.5 UPGRADE DOWNGRADE An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (rou
• CVE-2026-73618 HIGH 8.3 Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint
• CVE-2026-18691 HIGH 8.8 UPGRADE DOWNGRADE An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access t
• CVE-2026-73562 MEDIUM 6.5 Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment
• CVE-2026-18690 HIGH 8.1 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an
• CVE-2026-114644 MEDIUM 5.9 The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserializa
• CVE-2026-13059 HIGH 8.1 UPGRADE An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protect
• CVE-2026-114654 MEDIUM 6.5 A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range bi
• CVE-2026-13078 HIGH 7.7 UPGRADE A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally
• CVE-2026-113870 HIGH 8.8 MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline in
• CVE-2026-13077 HIGH 7.1 UPGRADE A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds
• CVE-2026-114648 HIGH 7.6 The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-
• CVE-2026-13065 MEDIUM 6.5 UPGRADE A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window functio
• CVE-2026-13074 MEDIUM 5.3 UPGRADE An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific
• CVE-2026-18688 HIGH 7.1 UPGRADE DOWNGRADE An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-boun
• CVE-2026-18693 HIGH 7.6 UPGRADE DOWNGRADE An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write p
• CVE-2026-18694 HIGH 7.1 UPGRADE DOWNGRADE An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileg
• CVE-2026-18706 MEDIUM 6.6 UPGRADE DOWNGRADE An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue ag
• CVE-2026-114646 MEDIUM 6.5 A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver
• CVE-2026-13060 MEDIUM 6.5 UPGRADE An authenticated user with limited read privileges may be able to access documents from collections they are n
• CVE-2026-13064 MEDIUM 6.5 UPGRADE Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consu
• CVE-2026-13071 MEDIUM 6.5 UPGRADE An authenticated user with read access can cause the mongod process to be terminated through certain aggregati
• CVE-2026-13075 MEDIUM 6.5 UPGRADE An authenticated user can cause the mongod process to be terminated by the operating system under memory press
• CVE-2026-13076 MEDIUM 6.5 UPGRADE An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pre
• CVE-2026-73617 HIGH 7.1 Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where us
• CVE-2026-9737 MEDIUM 6.5 UPGRADE DOWNGRADE During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly ha
• CVE-2026-13055 MEDIUM 6.5 UPGRADE The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB serve
• CVE-2026-13056 MEDIUM 6.5 UPGRADE Using expressions that generate large arrays it is possible to craft a query that creates very large intermedi
• CVE-2026-13058 MEDIUM 6.5 UPGRADE An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by send
• CVE-2026-18695 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaF
• CVE-2026-18696 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default priv
• CVE-2026-18699 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cau
• CVE-2026-18700 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to
• CVE-2026-18701 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause t
• CVE-2026-13066 MEDIUM 6.5 UPGRADE Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine ca
• CVE-2026-14881 HIGH 7.8 UPGRADE When importing connections in Compass it is possible to override some connection options that are otherwise ca
• CVE-2026-18705 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to
• CVE-2026-19003 HIGH 7.8 UPGRADE A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC D
• CVE-2026-48121 MEDIUM 6.7 @langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses Mongo
• CVE-2026-18888 MEDIUM 6.5 UPGRADE The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the
• CVE-2026-114652 MEDIUM 6.5 A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Dr
• CVE-2026-115929 MEDIUM 6.8 MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store
• CVE-2026-13069 MEDIUM 6.5 UPGRADE An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by s
• CVE-2026-18687 HIGH 7.1 UPGRADE DOWNGRADE MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain re
• CVE-2026-114651 MEDIUM 4.0 A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left
• CVE-2026-18702 MEDIUM 6.4 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modif
• CVE-2026-114643 MEDIUM 5.4 The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved
• CVE-2026-114649 MEDIUM 6.8 The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether
• CVE-2026-114653 MEDIUM 6.5 A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field i
• CVE-2026-13057 MEDIUM 5.3 UPGRADE An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access contr
• CVE-2026-13062 MEDIUM 6.5 UPGRADE An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify
• CVE-2026-18704 MEDIUM 6.5 UPGRADE An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges
• CVE-2026-18709 MEDIUM 6.4 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improper
• CVE-2026-18710 MEDIUM 6.5 UPGRADE A MongoDB driver component could write sensitive configuration information, including a credential used for ou
• CVE-2026-13063 MEDIUM 4.3 UPGRADE An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an
• CVE-2026-18698 MEDIUM 5.4 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an
• CVE-2026-13067 MEDIUM 6.3 UPGRADE When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates ma
• CVE-2026-13073 MEDIUM 4.3 UPGRADE An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuin
• CVE-2026-66750 MEDIUM 4.3 Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attack
• CVE-2026-114650 MEDIUM 5.9 A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for clien
• CVE-2026-114645 MEDIUM 5.2 A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause
• CVE-2026-13061 MEDIUM 4.3 UPGRADE An authenticated user may be able to view session metadata belonging to other users on the system through the
• CVE-2026-19502 MEDIUM 5.5 UPGRADE MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is
• CVE-2026-114647 MEDIUM 4.3 The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar si
• CVE-2026-13068 MEDIUM 4.2 UPGRADE An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to te
• CVE-2026-13070 MEDIUM 5.3 UPGRADE A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OC
• CVE-2026-18703 MEDIUM 4.2 UPGRADE DOWNGRADE An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user accoun

FAQ

How do I fix MongoDB vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is MongoDB being exploited right now?

None of the tracked MongoDB CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which MongoDB CVE should I patch first?

CVE-2026-19001 currently ranks highest (53/100): The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application s.

← Back to latest CVEs