MongoDB Server CVE-2026-8201

Exploitation requires: (1) Valid MongoDB authentication credentials to connect to the database, (2) Ability to control or influence the structure of a client's FLE-related query-this means either direct query submission capability or influence over application logic that constructs queries, (3) Client-side use of mongocryptd daemon or crypt_shared library for Field-Level Encryption. The vulnerability does NOT require special server configuration or non-default settings; standard FLE deployments are vulnerable. Exploitation is limited to authenticated sessions and depends on query structure manipulation rather than simple network-level exploitation, which significantly restricts the attack surface compared to unauthenticated or low-complexity remote code execution scenarios.

CVSS 6.4 with network attack vector and low complexity reflects moderate but real risk. The requirement for authentication (PR:L) and high complexity (AC:H) significantly limits attack surface compared to unauthenticated scenarios. However, the Availability impact rating (High) combined with Information Disclosure and Integrity impact indicates memory corruption with serious consequences. The vulnerability requires attacker control over query structure, which is feasible if the attacker can influence client-side query construction-a realistic scenario in applications accepting user input for MongoDB queries. EPSS and KEV status are not provided, so exploitation in the wild cannot be confirmed. The memory corruption nature (use-after-free) suggests potential for escalation if combined with other flaws, though the current CVSS does not reflect code execution. Real-world risk is moderate: the requirement for authentication and query structure control significantly reduces automated exploitation, but organizations using FLE with untrusted query inputs face genuine exposure.

An authenticated application user or attacker with database credentials crafts a MongoDB query with specially structured FLE encryption directives targeting the mongocryptd daemon. The malformed query triggers the use-after-free condition during query analysis, causing memory corruption that leaks sensitive information from the client process or crashes the encryption component, disrupting database operations. This scenario assumes the attacker can influence query construction-typical in applications with insufficient input validation or where application code constructs queries from user input.