Which versions of MongoDB Server are affected by CVE-2026-18696?

MongoDB Server contains a privilege escalation vulnerability (CVE-2026-18696, CVSS 7.0) in the applyOps command allowing authenticated users to modify collections beyond their authorization scope.. A patch is available.

How to fix or mitigate CVE-2026-18696?

Within 24 hours, identify all deployed MongoDB Server versions and assess which are affected by CVE-2026-18696; consult MongoDB's advisory to determine version-specific impact. Within 7 days, implement compensating controls: audit and restrict privilege grants to limit who can invoke applyOps, disable the applyOps command where not required for oplog replay, and enable MongoDB's audit logging focused on collection-level DDL operations. Within 30 days, establish continuous monitoring for privilege escalation attempts and unauthorized collection access; monitor MongoDB's official channels weekly for patch release announcements and prepare for immediate deployment when available.

MongoDB Server CVE-2026-18696

Q: What is the CVSS score of CVE-2026-18696?

CVE-2026-18696 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-56914 HIGH

Incorrect Authorization (CWE-863)

2026-08-11 mongodb

GHSA-85cq-4fh4-j8cv

Authentication Bypass MongoDB Mongodb Server

7.0

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible via MongoDB port with PR:H since exploitation requires specific non-default applyOps privilege; no confidentiality impact as only DDL operations are achievable.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 11, 2026 - 20:19 EUVD

Analysis Generated

Aug 11, 2026 - 20:16 vuln.today

CVE Published

Aug 11, 2026 - 18:40 cve.org

HIGH 7.0

DescriptionCVE.org

An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual operation.

AnalysisAI

Privilege escalation in MongoDB Server's applyOps command allows authenticated users holding specific non-default privileges to perform data-definition operations - such as dropping or modifying collections - against collections they are not authorized to access. The flaw (CWE-863, Incorrect Authorization) stems from an inconsistency in collection resolution between the authorization check and the actual execution path within applyOps, a mechanism typically used for oplog replay and atomic multi-operation writes. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 7.0 with VI:H and VA:H signals meaningful data integrity and availability risk for deployments with shared or loosely governed privilege models.

Technical ContextAI

MongoDB Server's applyOps command applies a sequence of BSON oplog entries atomically and is used internally for replication as well as by administrative tooling for bulk operations. CWE-863 (Incorrect Authorization) describes a class of flaws where a system performs an authorization check but then acts on a different resource than was checked - a form of time-of-check to time-of-use (TOCTOU) inconsistency at the authorization layer. In this case, the collection namespace resolved during the permission evaluation differs from the collection ultimately targeted by the DDL operation, allowing the privilege boundary to be bypassed. The CPE string cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:* covers all versions of MongoDB Server without a bounded version range, indicating the affected scope has not yet been precisely delimited in public data. The issue is specific to the applyOps command pathway, not standard CRUD operations, and is classified under the 'Authentication Bypass' tag in the reporter's taxonomy - more precisely, it is an authorization bypass affecting DDL-class operations.

RemediationAI

No specific patched version has been independently confirmed from available data; organizations should monitor the MongoDB Jira ticket SERVER-130139 (https://jira.mongodb.org/browse/SERVER-130139) and MongoDB's official security advisory channels for a confirmed fix release and apply it upon availability. As a compensating control, audit and restrict the applyOps privilege to only those roles that operationally require it - in MongoDB's role-based access control model, this means reviewing custom roles and built-in roles such as dbAdmin, clusterAdmin, and restore that may include applyOps access. Enforce the principle of least privilege by removing applyOps from any role that does not strictly need it, noting this may affect backup/restore workflows or replication tooling that relies on oplog replay. Consider adding database-level auditing for applyOps invocations to detect anomalous collection-targeting patterns. Network-level restrictions (e.g., binding MongoDB to internal interfaces only and restricting client access via firewall) reduce the attack surface but do not mitigate the flaw for users who already have legitimate network access.