mongodb vulnerabilities

Recent CVEs affecting mongodb products. 27 tracked.

mongodb has 27 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 27. Most recent: 2026-08-12. Highest priority: CVE-2026-19001 (score 53/100).

CVE-2026-18692 HIGH 8.8 UPGRADE DOWNGRADE An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with wr
CVE-2026-18697 HIGH 7.5 UPGRADE DOWNGRADE An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (rou
CVE-2026-18691 HIGH 8.8 UPGRADE DOWNGRADE An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access t
CVE-2026-18690 HIGH 8.1 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an
CVE-2026-18688 HIGH 7.1 UPGRADE DOWNGRADE An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-boun
CVE-2026-18693 HIGH 7.6 UPGRADE DOWNGRADE An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write p
CVE-2026-18694 HIGH 7.1 UPGRADE DOWNGRADE An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileg
CVE-2026-18706 MEDIUM 6.6 UPGRADE DOWNGRADE An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue ag
CVE-2026-18695 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaF
CVE-2026-18696 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default priv
CVE-2026-18699 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cau
CVE-2026-18700 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to
CVE-2026-18701 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause t
CVE-2026-18705 MEDIUM 6.5 UPGRADE DOWNGRADE An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to
CVE-2026-18687 HIGH 7.1 UPGRADE DOWNGRADE MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain re
CVE-2026-18702 MEDIUM 6.4 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modif
CVE-2026-18704 MEDIUM 6.5 UPGRADE An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges
CVE-2026-18709 MEDIUM 6.4 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improper
CVE-2026-18698 MEDIUM 5.4 UPGRADE DOWNGRADE An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an
CVE-2026-18703 MEDIUM 4.2 UPGRADE DOWNGRADE An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user accoun
CVE-2026-18710 MEDIUM 6.5 UPGRADE A MongoDB driver component could write sensitive configuration information, including a credential used for ou
CVE-2026-19001 CRITICAL 9.8 UPGRADE The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application s
CVE-2026-19004 HIGH 8.1 UPGRADE An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing
CVE-2026-19002 HIGH 8.1 UPGRADE A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Drive
CVE-2026-19003 HIGH 7.8 UPGRADE A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC D
CVE-2026-18888 MEDIUM 6.5 UPGRADE The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the
CVE-2026-19502 MEDIUM 5.5 UPGRADE MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is

FAQ

How do I fix mongodb vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is mongodb being exploited right now?

None of the tracked mongodb CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which mongodb CVE should I patch first?

CVE-2026-19001 currently ranks highest (53/100): The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application s.

Products

← Back to latest CVEs