Which versions of MongoDB Server are affected by CVE-2026-18712?

MongoDB Server Queryable Encryption contains a vulnerability (CVE-2026-18712, CVSS 7.2) enabling authenticated low-privileged database users to modify or destroy data across collections they are not…. A patch is available.

How to fix or mitigate CVE-2026-18712?

Within 24 hours: identify all MongoDB deployments using Queryable Encryption and audit low-privilege user account access; revoke or restrict low-privilege user permissions to Queryable Encryption-enabled collections and enable detailed audit logging for encryption maintenance operations. Within 7 days: complete inventory of affected production and development instances, validate all database access controls enforce least privilege, and document each low-privilege user account with database connectivity. Within 30 days: establish a patching plan to deploy MongoDB vendor fix once released for CVE-2026-18712; evaluate transitioning to alternative MongoDB encryption (server-side encryption, transparent data encryption) as interim protective measure; implement continuous monitoring for suspicious metadata namespace operations and collection access patterns by low-privilege users.

MongoDB Server CVE-2026-18712

Q: What is the CVSS score of CVE-2026-18712?

CVE-2026-18712 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-56885 HIGH

Incorrect Authorization (CWE-863)

2026-08-11 mongodb

GHSA-jpw7-w4h8-xcfw

Authentication Bypass MongoDB Mongodb Server

7.2

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-exploitable with low privilege (authenticated collection user); scope unchanged as impact is confined to the same MongoDB server; no confidentiality impact per description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 11, 2026 - 20:19 EUVD

Analysis Generated

Aug 11, 2026 - 20:13 vuln.today

CVE Published

Aug 11, 2026 - 18:49 cve.org

HIGH 7.2

DescriptionCVE.org

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.

AnalysisAI

Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to cause unauthorized modification or destruction of data in collections beyond their authorization scope. The flaw stems from insufficient validation of internal metadata namespace references during operations such as compaction, allowing a user scoped to one encrypted collection to trigger damaging actions against a logically separate collection. No public exploit has been identified and this vulnerability is absent from the CISA KEV catalog, but the high integrity and availability impact warrants urgent prioritization for any deployment leveraging the Queryable Encryption feature.

Technical ContextAI

MongoDB Queryable Encryption (QE) is an enterprise feature introduced in MongoDB 6.0 that enables server-side querying of client-encrypted fields without exposing plaintext. Internally, QE relies on auxiliary state collections - such as ESC, ECOC, and ECC metadata structures - that track encryption state and are consumed during maintenance operations like compaction and cleanup. CWE-863 (Incorrect Authorization) identifies the root cause: during these maintenance routines, the server resolves namespace references embedded in internal metadata and acts on those namespaces without adequately verifying that the requesting principal holds authorization over the target namespace. The CPE string cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:* covers all MongoDB Server versions, though the vulnerability is only exploitable through the QE code path. The Jira reference SERVER-130633 is the authoritative vendor tracking entry.

RemediationAI

Monitor the MongoDB Jira ticket SERVER-130633 at https://jira.mongodb.org/browse/SERVER-130633 and apply the vendor-released patch as soon as a fixed version is published; no specific fix version is confirmed from data available at time of analysis, so do not assume a particular release resolves this issue without vendor confirmation. As an immediate compensating control, audit and tighten database role assignments for all users who interact with Queryable Encryption collections, ensuring strict least-privilege enforcement so that no user holds unnecessary collection-level maintenance rights - this reduces the pool of principals capable of triggering the vulnerable maintenance operation path. If operational constraints permit, consider suspending scheduled Queryable Encryption compaction jobs in high-sensitivity environments until a patch is applied; note that deferring compaction will cause encrypted query performance to degrade over time as state collections grow. Enable and monitor MongoDB audit logging for unexpected cross-namespace write or delete operations as a detection layer for exploitation attempts.