EUVD-2026-98818
GHSA-8w3x-ww8f-273q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with read access
-
ExploitCraft aggregation pipeline with constant values
-
ExecutionTrigger faulty internal query rewrite
-
ImpactReceive unintended field values in output
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated MongoDB Server user holding read access who issues an aggregation-framework query; the flaw only manifests 'under certain conditions' when constant values are handled during internal query rewriting, so a specifically shaped aggregation pipeline is needed rather than arbitrary queries. Limiting factors: valid credentials with read access are mandatory (no unauthenticated path), impact is confined to disclosure of unintended field values (no write, no code execution, no denial of service), and the triggering conditions are not guaranteed for all pipelines. No special non-default server configuration is identified in the available data. |
| Impact | This is a medium-severity information-disclosure issue, not the critical RCE the tags imply. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) scores 5.3 and shows only LOW confidentiality/integrity impact and NO availability impact - inconsistent with the 'RCE'/'Code Injection' tags and the CWE-94 (Code Injection) classification, which all over-state the technical impact; the actual described behavior is leakage of unintended field values during aggregation, a confidentiality problem. Exploitation requires an authenticated user with read access (PR:L), which materially limits the attacker population to those already holding valid database credentials. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit code was identified - the only reference is a MongoDB Jira tracking ticket (SERVER-134618). There is no signal of active exploitation or weaponization. Net: a legitimate bug worth patching during normal maintenance cycles, but not an emergency; the high-threat tags conflict with every quantitative signal and should be disregarded. |
| Exploit ScenarioDerived | An authenticated user holding only read access constructs an aggregation pipeline that, under specific conditions, triggers the constant-handling flaw in MongoDB's internal query rewriting. The server returns field values the query was not authorized or intended to return, exposing data beyond the user's expected result set. No public proof-of-concept exists, and exploitation depends on the user already having valid credentials with read access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Authenticated MongoDB Server users who hold read access can receive field values in aggregation-framework output that their query did not intend to return, because certain constant values are handled incorrectly during internal query rewriting. Exploitation requires valid credentials with read privileges and a specifically shaped aggregation pipeline; there is no unauthenticated path, no write primitive, and no code execution or denial-of-service impact, so this is best treated as a medium-severity information-disclosure issue despite reference tags that mention RCE and code injection. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed CVSS 3.1 score of 5.3 is driven by low confidentiality impact with no integrity or availability effect.
RemediationAI
No vendor-released patch was identified in the available data; the only authoritative tracking source provided is the MongoDB JIRA issue at https://jira.mongodb.org/browse/SERVER-134618, and that issue should be monitored for the fixed release lines and exact patched version numbers before upgrading. Until a fix is published and deployed, the practical compensating controls are privilege-based rather than feature-based, because MongoDB provides no switch to disable the aggregation framework. First, tighten role-based access control so that collection- and database-level read privileges are granted only where operationally required, replacing broad readAnyDatabase roles with narrowly scoped read grants; the trade-off is more administrative overhead and possible friction for legitimate analytics users. Second, where ad-hoc aggregation is not required, expose pre-defined read-only views with fixed pipelines instead of allowing clients to submit arbitrary aggregation queries against raw collections, which removes the attacker's ability to shape the triggering pipeline at the cost of reduced analytical flexibility. Third, enable MongoDB auditing on aggregate commands and project-stage usage and alert on unusual or newly appearing pipeline shapes from accounts that normally do not run aggregation, accepting the storage and performance cost that auditing introduces. Finally, rotate and monitor credentials for read-only accounts, since valid read credentials are a hard prerequisite and limiting their spread directly narrows the attack surface. Do not rely on the RCE and code-injection tags as a guide to severity when prioritising; no code execution, write, or availability impact was confirmed, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in MongoDB Server's aggregation framework, specifically in the query-rewriting stage where the server simplifies or folds constant expressions before execution. When such constants are mishandled during rewriting, the generated internal query can resolve to a different set of projected field values than the pipeline author specified, leaking data that should not have been in the result set. The vendor classifies the root cause as CWE-94 (improper control of generation of code, i.e. 'code injection'), which is what drives the RCE and code-injection tags in the source metadata; however, the assessed impact is a read-scope information disclosure only, so the true weakness class is closer to improper handling of constants leading to unintended data exposure. The CPE entry cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:* is a wildcard with no version boundaries supplied, so the precise affected release range is not determinable from the provided data and must be taken from the vendor JIRA issue SERVER-134618. Note the divergence between the supplied CVSS 4.0 vector (VC:L/VI:L, i.e. low confidentiality and low integrity) and the independent assessment (C:L/I:N/A:N under CVSS 3.1), which is the authoritative view: confidentiality-only, network-reachable, authenticated.
Know when MongoDB gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable database (AV:N) exploited by an authenticated read user (PR:L); impact is limited unintended data disclosure, so C:L with no integrity or availability effect.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
2DescriptionCVE.org
An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Exploit-DB