EUVD-2026-47799Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated write access is required (PR:L) over the network with low complexity; impact is corruption of encrypted query correctness (I:H) with no confidentiality or availability loss.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.
AnalysisAI
Integrity corruption in MongoDB's Queryable Encryption on sharded clusters lets an authenticated user with write access to a QE-enabled collection tamper with server-controlled encryption metadata by routing crafted write commands through the mongos router, breaking the correctness of encrypted queries. The CVSS 4.0 vector (VI:H, VC:N, VA:N) confirms this is an integrity-only issue despite the input's 'Information Disclosure' tag, which appears mislabeled. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Queryable Encryption (QE) is MongoDB's feature enabling searchable client-side field-level encryption, where the server stores encrypted payloads plus internal metadata used to keep encrypted indexes and query results correct. This metadata is meant to be exclusively server-controlled. On a sharded cluster, clients connect through the mongos query router, which brokers write commands to the underlying shards - placing it in the position of an intermediary. The root cause maps to CWE-441 (Unintended Proxy or Intermediary / 'Confused Deputy'): the mongos router does not sufficiently validate that user-supplied write commands are barred from touching internal encryption metadata fields, so a client can direct the trusted router to mutate state it should not be able to reach. The result is corruption of the data structures QE relies on to return correct encrypted query results.
RemediationAI
No exact fixed version was included in the provided data, so track and apply the resolution referenced in MongoDB's ticket SERVER-127831 (https://jira.mongodb.org/browse/SERVER-127831) and upgrade to the patched MongoDB server release once published for your branch. Because exploitation requires write privileges on a QE-enabled collection routed through mongos, effective compensating controls until patching include tightening role-based access control to remove or minimize write grants on Queryable Encryption collections (trade-off: may block legitimate application writes), auditing mongos write command activity against QE collections for anomalous metadata-field manipulation, and, where operationally feasible, limiting which application identities can reach QE-enabled sharded collections. Do not rely on network controls alone, since the attacker is an authenticated database user rather than an anonymous remote party.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today