Is there a patch available for CVE-2026-8201?

Yes, a patch is available for CVE-2026-8201. Update the affected software to the latest version immediately.

MongoDB Server CVE-2026-8201

Q: What is the CVSS score of CVE-2026-8201?

CVE-2026-8201 has a CVSS 4.0 base score of 6.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29892 MEDIUM

Use After Free (CWE-416)

2026-05-13 mongodb

GHSA-r8cx-9wfm-r3m7

Information Disclosure Use After Free Memory Corruption Mongodb Server

6.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 13, 2026 - 15:52 NVD

6.4 (MEDIUM) 6.1 (MEDIUM)

Patch available

May 13, 2026 - 01:17 EUVD

Analysis Generated

May 13, 2026 - 01:15 vuln.today

CVE Published

May 13, 2026 - 00:12 nvd

MEDIUM 6.4

DescriptionCVE.org

A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.

This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

AnalysisAI

Use-after-free in MongoDB Server's Field-Level Encryption query analysis component allows authenticated remote attackers with control over FLE query structure to cause information disclosure and denial of service. The vulnerability affects mongocryptd and crypt_shared in versions 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. No public exploit code identified at time of analysis.

Technical ContextAI

MongoDB's Field-Level Encryption (FLE) provides client-side encryption of sensitive data before transmission to the database. The mongocryptd daemon and crypt_shared library handle query analysis and encryption/decryption operations on the client side. The vulnerability is a use-after-free defect (CWE-416) in the FLE query analysis component, where memory is referenced after being freed. This typically occurs when pointer management fails to track object lifecycle correctly, allowing subsequent operations to access dangling references. An authenticated attacker controlling the structure of FLE-related queries can craft payloads that trigger improper memory reuse, potentially leading to information disclosure through memory corruption or service interruption.

RemediationAI

Upgrade MongoDB Server to patched versions: 7.0.34 or later, 8.0.23 or later, 8.2.9 or later, or 8.3.2 or later. Organizations unable to patch immediately should implement access controls restricting authenticated users who can submit FLE queries to trusted applications only, reducing the attack surface by limiting who can control query structure. Disable Field-Level Encryption on client instances if the feature is not required for the application's use case-this eliminates exposure entirely but may impact data protection strategy. Monitor applications for unusual memory-related errors or crashes correlated with FLE query patterns. These compensating controls trade functionality (encryption availability or user flexibility) against reduced risk exposure until patching is feasible.