Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 7 total.
Query planner crash via $meta sort expression in MongoDB (CVE-2026-9737)
During query planning, MongoDB does not correctly handle the `$meta` expression when processing sort patterns in raw BSON object form. This leads to incorrect transformations that can trigger an invariant failure and ...
Fixed in 8.2.12; 8.0.28; 7.0.39; 8.3.7
Information disclosure via DBPointer handling in MongoDB server-side JavaScript (CVE-2026-13066)
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can cause internal process memory contents to be included in data returned to the client. This constitutes an...
Fixed in 7.0.39; 8.0.28; 8.2.12; 8.3.7; 9.0.0-rc1; 9.1.0-rc0
Denial of service via $linearFill window function in MongoDB (CVE-2026-13065)
A read-only user can craft an aggregation pipeline using the $linearFill window function operator with an expression-based sortBy expression to cause the mongod process to terminate abnormally. This results in a denia...
Fixed in 8.2.12; 8.0.28; 7.0.39; 8.3.7; 9.1.0-rc0; 9.0.0-rc1
CPU exhaustion via exponential $jsonSchema hashing in MongoDB (CVE-2026-13064)
A flaw in MongoDB's query planning code causes hashing of query solutions involving deeply nested `$jsonSchema` constructs (specifically `InternalSchema*` match expressions) to exhibit exponential time complexity rath...
Fixed in 9.0.0-rc0; 8.2.12; 8.0.28; 8.3.7
Authorization bypass via duplicate field in MongoDB $graphLookup (CVE-2026-13060)
An inconsistency between MongoDB's authorization and execution phases of the `$graphLookup` aggregation stage allows an authenticated user with limited read privileges to access documents from collections they are not...
Fixed in 9.0.0-rc0; 8.3.7; 8.2.12; 8.0.28; 7.0.39
Authenticated denial of service via $_internalIndexKey in MongoDB (CVE-2026-13055)
An authenticated MongoDB user can crash a mongod server by submitting an aggregation pipeline containing the `$_internalIndexKey` expression with a compound wildcard index specification. The expression fails to handle...
Fixed in 8.2.11; 8.2.12; 8.0.28; 7.0.39; 8.3.7
Denial of service via missing transaction field validation in MongoDB (CVE-2026-13058)
An authenticated user with basic write privileges can send a `startOrContinueTransaction` command without the required `autocommit` field, triggering a fatal internal invariant failure in `initializeOperationSessionIn...
Fixed in 8.2.11; 8.2.12; 8.0.28; 8.3.7; 9.1.0-rc0; 9.0.0-rc1