EUVD-2026-35853
GHSA-87xp-xhjm-qgrh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (mongodb) · only source for this CVE.
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command
AnalysisAI
Information disclosure in MongoDB Server allows authenticated users holding the read role to obtain small amounts of uninitialized stack memory by submitting specially-crafted filemd5 commands. The flaw stems from CWE-457 (Use of Uninitialized Variable) in the filemd5 command handler, and while no public exploit has been identified at time of analysis, the low attack complexity and network reachability make it a credible insider/credential-theft risk against MongoDB databases.
Technical ContextAI
MongoDB is a widely deployed document-oriented NoSQL database. The filemd5 command is a legacy GridFS-related operation used to compute the MD5 hash of a file stored across chunks in a GridFS collection. The root cause is CWE-457 (Use of Uninitialized Variable): the command handler reads stack memory that has not been deterministically initialized before the data is returned to the caller, causing residual bytes from prior function frames to leak across the wire protocol boundary. Because filemd5 is accessible to any role granting the read privilege (which is the baseline read-only role in MongoDB's RBAC model), the exposure is wider than commands restricted to clusterAdmin or dbOwner.
RemediationAI
Patch available per vendor advisory - consult MongoDB SERVER-122207 (https://jira.mongodb.org/browse/SERVER-122207) for the fixed release on each supported branch (the input data does not name an exact released version, so verify the patched build against the ticket before deploying). Until patched binaries can be rolled out, the most direct compensating control is to restrict who holds the read role: audit role grants, remove the built-in read role from low-trust application accounts, and prefer narrowly scoped custom roles that do not include the find privilege on GridFS-backed collections where filemd5 can be invoked. Where GridFS is not actually used, dropping the fs.files and fs.chunks collections (or denying find on them) effectively removes the attack surface; the trade-off is that any application relying on GridFS file storage will break, so confirm usage first. Network-level mitigations (binding mongod to internal interfaces, requiring TLS client certificates, fronting with an authentication proxy) reduce the population of attackers able to reach the wire protocol but do not stop a malicious or compromised legitimate read-role user.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log e
Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to cras
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompr
A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain acc
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today