EUVD-2026-56905
GHSA-5v9h-3hj6-76w4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires write-privileged authentication and a specific lifecycle prerequisite (AT:P maps to AC:H in 3.1); no scope change; full C/I/A impact from potential code execution and server crash.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.
AnalysisAI
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level privileges to corrupt internal server memory, potentially crashing the server process or executing unintended code. The CVSS 4.0 score of 7.7 reflects a network-reachable vulnerability tempered by a low-privilege authentication requirement and a specific attack prerequisite (AT:P), indicating the flaw requires a particular lifecycle state in timeseries collections rather than a simple, reliable trigger. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires authenticated access to MongoDB Server with write-level privileges (PR:L), ruling out unauthenticated attacks entirely. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.7 with vector AV:N/AC:L/AT:P/PR:L reflects meaningful severity on a network-reachable service, but three factors significantly temper real-world urgency: the attacker must hold authenticated write credentials (PR:L), a specific prerequisite state must be present (AT:P - likely the active use and particular lifecycle phase of timeseries collections), and no public exploit code or CISA KEV listing exists at time of analysis. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid MongoDB account holding write privileges connects to a network-accessible MongoDB instance that uses timeseries collections and issues a crafted sequence of write operations designed to interact with the bucket lifecycle management code at a vulnerable state transition. The crafted operations cause an internal pointer to reference an already-freed memory region, and a subsequent server operation dereferences that stale pointer, either crashing the mongod process or potentially diverting execution to attacker-influenced memory. … |
| Remediation | No vendor-released patch has been identified at time of analysis; the MongoDB JIRA ticket SERVER-129887 at https://jira.mongodb.org/browse/SERVER-129887 is the sole available reference and should be monitored for fix version announcements and release notes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory MongoDB Server instances, identify those with timeseries collections, and audit accounts with write-level database access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mongodb Server
View allCredential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network a
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authen
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read pe
Remote unauthenticated denial-of-service in MongoDB Server's BSON validation layer allows attackers to crash the mongod
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos
Pre-authentication denial-of-service in MongoDB Server allows unauthenticated remote clients to crash the database proce
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privile
Memory disclosure and denial-of-service in MongoDB Server allows any authenticated user with aggregate command privilege
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to ca
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue
Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today