MongoDB
Monthly
Missing authorization in Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 allows unauthenticated REST API clients on MongoDB deployments to delete the internal _SCHEMA collection, stripping class field definitions, class-level permissions and protected fields so affected data becomes readable and modifiable by any client. PostgreSQL deployments are explicitly not affected and object ACLs continue to apply; no public exploit has been identified at time of analysis. The vendor and independent assessment rate this high severity (CVSS 8.8, assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and a near-term priority for MongoDB-backed installations with reachable REST endpoints; vendor patches are available for both affected release branches.
Client-side field-level encryption (CSFLE) in the MongoDB C# / .NET Driver before 3.13.0 can silently fail to encrypt fields that an application designated for protection, so data intended to be ciphertext is stored and returned in cleartext. The flaw sits in the schema-construction component that turns caller-supplied field identifiers into pattern expressions, so it only affects applications that build automatic-encryption schemas through the affected PatternProperty overload; the same defect can also make a rule apply more broadly than intended. Discovery requires no user interaction, and the party reading the unprotected values only needs ordinary authenticated read access to the stored data (PR:L in the assessed vector) - not the encryption keys - though it is not a default configuration and no public exploit was identified at time of analysis; the driver fixes it in 3.13.0.
Integrity-only NoSQL injection in the MongoDB C# Driver update-statement builder allows an authenticated application user with ordinary read-write access to influence update logic, potentially modifying or deleting stored data the application did not intend to change. The flaw is tracked as CSHARP-6168 and affects releases before 3.13.0; exploitation depends on the application passing attacker-influenced values directly into the affected update builder surface, so it is not reachable against a hardened application that does not do so. No public exploit was identified in the provided intelligence at time of analysis, and the primary remediation is upgrading to MongoDB .NET/C# Driver 3.13.0.
Identity impersonation in the MongoDB C#/.NET Driver allows one application user to execute database operations under another user's X.509 identity, affecting the confidentiality and integrity of everything that identity can reach. The driver's shared connection cache keys TLS client certificates only by issuer and serial number, so a user who copies a victim certificate's issuer and serial into their own certificate - without holding the victim's private key - can be handed a cached connection already authenticated as the victim. The flaw requires a specific multi-tenant architecture where one host application builds multiple clients from per-user certificates while sharing a connection pool; there is no public exploit identified at time of analysis, but the underlying patch is shipped in version 3.13.0.
NoSQL injection in MongoDB C# Driver before 3.13.0 lets an authenticated application user redirect LINQ-generated field paths by supplying dictionary keys, field names, or array-filter identifiers that contain dot or dollar characters. This can expose other users' documents, widen update operations beyond intended data, or write malformed fields that leave stored documents unreadable until repaired. The issue is a moderate-priority concern limited to applications that pass attacker-controllable input into field-name positions; no public exploit was identified at time of analysis, and it is fixed in driver 3.13.0.
Signals point to a real but bounded availability risk rather than a top-tier emergency: the MongoDB C# Driver's BSON library interns every BsonSymbol produced during deserialization and retains those symbols for the lifetime of the process with no cap, so an unauthenticated remote party able to get attacker-influenced BSON or JSON deserialized can drive unbounded memory growth and deny service to the host application (availability-only; assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, CNA CVSS 4.0 score 8.2). Exposure is conditional - the application must actually deserialize untrusted content through the driver and that content must carry BSON symbol values; merely having the driver installed is not a trigger, and no MongoDB server component is affected. No public exploit code or confirmed active exploitation has been identified at time of analysis; version 3.13.0 removes symbol interning as the fix.
MongoDB Compass before 14.9.15 can execute arbitrary code with the privileges of the user running Compass when that user connects to a MongoDB deployment containing a specially crafted stored view and opens that view for editing. The underlying issue is improper escaping of BSON values while Compass converts a view's aggregation pipeline into editable source, so attacker-controlled view definitions can break out into executable code. The assessed CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and no public exploit code or confirmed active exploitation was identified at time of analysis; exposure is concentrated in shared, hosted, or multi-tenant deployments where an attacker can create or modify views that a victim later opens.
MongoDB Server sharded clusters running versions 9.0 before 9.0.4 or 8.3.0 before 8.3.13 allow an authenticated user with write privileges on a regular collection to bypass authorization checks for internal system namespaces by submitting a bulk write operation through the mongos router. This incorrect authorization (CWE-863) can result in unauthorized writes to system namespaces, with an impact ranging from low integrity to high availability depending on the namespace targeted. No public exploit identified at time of analysis; vendor patches are available in MongoDB Server 9.0.4 and 8.3.13.
Null pointer dereference in MongoDB Server's collection validation feature enables an authenticated user with write access to crash the mongod process, producing a denial-of-service condition. The attacker must be able to create or modify a collection validator (for example via create or collMod with a validator document containing the mishandled expression); the crash is then triggered when a document is inserted into that collection and evaluated against the validator. Impact is limited to availability - no confidentiality or integrity loss - and the issue is most exploitable in shared or multi-tenant deployments where write and schema-validation privileges are broadly granted; no public exploit code was identified at time of analysis, and this is a moderate-severity availability issue rather than a widespread emergency.
Memory exhaustion in MongoDB Server lets an authenticated user with only read-only privileges crash the mongod process by running an aggregation query whose $match stage nests internal schema-validation operators against documents containing array fields. Because those operators are accepted in user-supplied query filters despite being intended for server-side $jsonSchema validation, the match expression evaluator expands every combination of array elements without an adequate resource limit, so memory grows until mongod is OOM-killed. Impact is availability only - no data disclosure or modification - and the issue requires an authenticated account (CVSS PR:L) plus the right document shape, so it is a genuine but moderate-priority DoS rather than an emergency; no public exploit code or confirmed active exploitation has been identified at time of analysis, and CVSS 4.0 scores it 7.1 (attack vector network, high availability impact).
Remote unauthenticated attackers can interfere with other clients' database writes in Parse Server versions 5.4.0 through 8.6.95 and 9.0.0 through 9.10.2-alpha.4 by exploiting a race condition in transactional batch request handling that shares state across concurrent requests. Successful exploitation requires a transaction-capable backend (PostgreSQL or MongoDB replica set/sharded cluster) and concurrent requests from multiple clients; it can lead to rollback of acknowledged writes and, on PostgreSQL, indefinitely open transactions that cause subsequent writes to fail. No public exploit code has been identified at the time of analysis, and the flaw is not confirmed as actively exploited.
Denial of service in the MongoDB Go Driver can be triggered when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte BSON array supplied by an unauthenticated remote source, causing an out-of-bounds index and a runtime panic that may terminate the unprotected process. The CVE carries a CVSS 4.0 base score of 8.2, but our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects the prerequisite that the vulnerable Validate methods must be invoked on attacker-controlled raw BSON; applications that never call these methods on untrusted input or that recover from panics are not materially impacted. No public exploit identified at time of analysis, no confidentiality or integrity impact has been identified, and the realistic blast radius is availability of the specific unprotected process.
Malformed BSON bytes fed to the MongoDB Go Driver can trigger an integer overflow in the driver's BSON value-length handling (CWE-190) and cause a runtime panic; because an unrecovered Go panic terminates the process, an unauthenticated remote attacker who can control BSON input reaching an application's validation or value-access path can cause a denial of service. The exposure is genuine but bounded: the driver's own server-monitoring path already contains panic recovery and degrades only to a server-selection failure, and applications that wrap BSON parsing in their own recovery, or never pass untrusted BSON into the driver, are not affected. No public exploit code has been identified at time of analysis, and no EPSS score was provided in the source data.
Memory corruption in MongoDB libmongocrypt lets an authenticated actor who can modify key vault documents - or a malicious or compromised MongoDB server - crash or corrupt the memory of any client application that has Client-Side Field Level Encryption (CSFLE) or Queryable Encryption enabled. The trigger is a crafted key document containing duplicate masterKey fields, which causes provider-specific KMS data to be mis-typed during key-document cleanup, producing invalid memory access and invalid frees (CWE-843 type confusion). Scored 8.7 under CVSS 4.0, while our own assessment is more conservative at CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H, placing the confirmed impact at client-side crash and memory corruption rather than proven remote code execution; no public exploit code identified at time of analysis, and exploitation requires that encryption be in use plus key-vault write privileges (PR:L) or a hostile server.
Denial of service in MongoDB libmongocrypt occurs when KMS endpoint parsing triggers an integer underflow, causing an allocation failure that terminates the application process. This can be triggered by an authenticated user with write access to the key vault collection modifying a key document, or when an application passes a KMS endpoint containing a colon after its path or query during key creation. No public exploit code has been identified at time of analysis, and the vulnerability does not allow code execution, data disclosure, or data tampering-only a crash.
Field-level write access control in the MongoDB adapter for Payload CMS (@payloadcms/db-mongodb) can be bypassed by an authenticated user who already holds document-update rights, allowing that user to write values into fields their role was explicitly configured to be unable to modify. Only MongoDB-backed deployments running @payloadcms/db-mongodb before 3.87.0, or canary builds before 4.0.0-canary.20, are affected - the Postgres and SQLite adapters are explicitly unaffected. There is no unauthenticated path and no public exploit identified at time of analysis, but the CVSS 3.1 base score is 7.1 (High, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) because the integrity impact of silently rewriting protected fields is severe once an attacker has any update-capable account.
An integer overflow in the BSON encoder of the MongoDB Python Driver's bundled native C extension (PyMongo before 4.18.2) can cause an out-of-bounds write inside the process hosting the driver when an application encodes a single document built from an unusually large (~2 GB) caller-supplied value. Only builds that link the C extension are affected - the pure-Python BSON fallback is not - and successfully triggering it requires that a large attacker-influenced value actually reach the encoding path, so most applications are exposed only through data they already accept from untrusted sources. The flaw is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; the vendor has released 4.18.2 as the fixed version, and because impact is confined to the hosting application's own process, risk is best treated as a genuine but precondition-heavy memory-corruption issue.
Attackers can inject arbitrary additional servers into a PyMongo (MongoDB Python Driver) client's connection topology by smuggling the percent-encoded form of a host-list delimiter (for example %2C) inside a hostname value that an application places into a connection string, because PyMongo decodes percent-escapes before it splits the host list. The request is unauthenticated (CVSS 4.0 PR:N) but carries an attack-requirement prerequisite (AT:P): the target application must build a URI at runtime from a host the attacker can influence, meaning static or hardcoded connection strings are not exploitable. MongoDB's own CVSS 4.0 rating of 8.3 (High) is driven by a high integrity impact - the client may route its authentication exchange and subsequent database operations to the rogue host, which can observe limited information and return altered query results. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in PyMongo 4.18.2.
Heap out-of-bounds write in the MongoDB C Driver (libmongoc) allows an unauthenticated attacker who controls DNS resolution and the responses of hosts in a client's connection string to corrupt memory and crash the application. Exploitation requires a privileged network position (MITM or rogue server) and results in denial of service, not code execution or data disclosure. Patched versions 1.30.12 and 2.5.5 are available; no public exploit code or active exploitation has been identified at time of analysis.
Code injection in MongoDB Compass lets an attacker who holds database-creation privileges on a MongoDB server interpolate unescaped shell syntax into the initial input of Compass's embedded MongoDB shell; when a victim user navigates to that database's view and explicitly opens the shell from it, the injected content is evaluated inside the Compass client process with that process's privileges. Exploitation is constrained: the attacker must be able to create databases on the connected server and name one maliciously, and the victim must perform the specific action of opening the shell for exactly that database, which is why the issue carries High attack complexity despite the 7.3 severity. Execution is confined to the Compass client process and does not reach the MongoDB server; Compass v1.49.12 is the fixed release, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Cache lock takeover in the MongoDB integration for Laravel (mongodb/laravel-mongodb) before 5.11.0 lets an authenticated user who can influence the lock 'owner' value hijack or prematurely expire a lock held by another process, producing duplicated or conflicting operations. The root cause is a NoSQL/aggregation-expression injection (CWE-943) in the MongoLock implementation, where a dollar-prefixed owner string such as '$owner', '$literal' or '$$ROOT' is evaluated by MongoDB as an aggregation expression instead of being treated as a literal value. CVSS 7.1 (VI:H, VA:L, no confidentiality or scope impact) places this as a genuine but moderate integrity-focused flaw: it only affects deployments using the MongoDB cache-lock backend on pre-5.11.0 versions, exploitability depends on the application deriving lock owner values from user-influenced input (not the standard usage pattern), and no public exploit code has been identified at time of analysis.
Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database privileges to trigger unsynchronized concurrent thread access to shared internal memory over the standard client protocol, leading to server termination and potential corruption of process memory with user-influenced content. The flaw affects confidentiality, integrity, and availability of the MongoDB server process - worst-case outcomes range from a reliable denial-of-service crash loop to a write primitive enabling memory disclosure or data manipulation. No public exploit has been identified at time of analysis, and the race condition's timing dependency (AT:P in the CVSS 4.0 vector) moderates reliable exploitability despite the high theoretical impact.
Use-after-free in the reactive client-side encryption component of the MongoDB Java Driver allows a party that can cancel an in-flight encrypted operation to crash the hosting application process. The flaw surfaces only when the reactive encryption stack is active and KMS credentials are fetched on demand - a specific non-default configuration - making the affected population a subset of all Java Driver deployments. No public exploit code or active exploitation has been identified at time of analysis; impact is confined to availability (process termination), with no confidentiality or integrity consequence.
NoSQL injection in the MongoDB integration for Laravel (laravel-mongodb PHP) allows an authenticated low-privilege user to manipulate polymorphic relation identifiers, causing the application to return documents outside the intended relation target. The vulnerability (CWE-943) exploits the boundary between data and query logic in MongoDB's operator-based query model: a crafted relation identifier stored by an attacker is later interpreted as a MongoDB query condition rather than a literal string during relation resolution. No active exploitation has been identified, and no public proof-of-concept is known at time of analysis; the issue is tracked in MongoDB JIRA as PHPLARA-265.
NoSQL injection in the MongoDB-Laravel PHP integration's embedded-document relation handling allows an authenticated low-privilege user to manipulate embedded record identifiers so they are evaluated as query operators rather than literal values. Exploitation can result in mass deletion of all embedded documents within a targeted parent record, or silent overwrite of an unintended embedded document, depending on how the injected condition is constructed. No public exploit code has been identified at time of analysis, and no CISA KEV entry exists, but the network-accessible attack surface and low authentication barrier make this a meaningful integrity risk for any application exposing user-controlled identifiers to embedded-relation operations.
Regex metacharacter injection in the MongoDB C# Driver's LINQ query translation layer allows an authenticated low-privilege user to alter generated regular-expression predicates, causing the application to return database records beyond those the original filter was designed to expose. The vulnerability, reported by MongoDB and tracked under CSHARP-6177 (CWE-943), requires only network access and a low-privilege account - making it a meaningful access-control risk in any .NET application that incorporates user input into LINQ regex-based queries against MongoDB. No public exploit has been identified at time of analysis, and no EPSS or KEV data is present in available intelligence.
NoSQL injection in the MongoDB integration for Laravel PHP allows a remote unauthenticated attacker to subvert equality filter operations across three specific API code paths. When user-controlled input delivers an operator-shaped array to the `where` (equality), `find`, or `delete` methods, MongoDB interprets the array as a query condition rather than a literal value - enabling unauthorized document reads and out-of-scope document deletion. No confirmed active exploitation or public exploit code exists at time of analysis, but the integrity and availability impacts (VI:H, VA:H in CVSS 4.0) are severe given that bulk or arbitrary document deletion may be irreversible.
MongoDB Server's query planning component harbors a CWE-190 integer overflow that enables an authenticated database user with ordinary read/write privileges to crash the entire server node via a specially crafted query. The overflow bypasses an internal resource limit during query planning, triggering unbounded memory consumption that terminates the server process and denies service to all databases hosted on that node. Affected release lines are 7.0.x (below 7.0.41), 8.0.x (below 8.0.30), and 8.3.x (below 8.3.9); MongoDB has released patches for all three; no public exploit or CISA KEV listing was identified at time of analysis.
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network access to a router port to supply crafted connection-monitoring parameters that consume unbounded server CPU, degrading or denying service to legitimate clients. The flaw is restricted to sharded deployments running mongos - standalone or replica-set-only mongod instances are not in scope. No authentication, privileges, or user interaction are required; only availability is affected, with no confidentiality or integrity impact. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Incorrect authorization in MongoDB Server's aggregation framework allows an authenticated low-privilege user to craft a specially formatted aggregation request that causes the authorization subsystem to evaluate a different operation than what the execution engine actually runs, resulting in unauthorized read access to collection data within the target database. Affected versions span MongoDB Server 7.0.0-7.0.40 and 8.0.0-8.0.29; vendor-released patches are available at 7.0.41 and 8.0.30 respectively. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low privilege requirement and network accessibility elevate the realistic threat in multi-tenant or role-segregated MongoDB deployments.
MongoDB Server 8.3.0-8.3.8 exposes an authorization bypass in the aggregation framework that allows a low-privilege authenticated user to read data from collections they are not authorized to access. The bypass is reachable only when Atlas Search features are active and works by manipulating an internal command parameter that the server failed to guard from external client input, causing a view-level security check to be skipped. No public exploit code has been identified at time of analysis, and exploitation requires an authenticated account.
Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.
MongoDB Server's diagnostic reporting interface exposes cleartext credentials from in-flight administrative operations to any authenticated user holding monitoring-level privileges, creating a lateral-movement and privilege-escalation path via impersonation of higher-privileged accounts. Affected versions span the 7.0.x branch (before 7.0.41), 8.0.x branch (before 8.0.30), and 8.3.x branch (before 8.3.9). The server's log subsystem correctly redacts credential material, but an equivalent sanitization pass is absent from the diagnostic interface's serialization path, producing an inconsistent security boundary across two observability outputs for the same underlying data.
Persistent denial-of-service in MongoDB Server allows any authenticated user with write privileges to trigger a fatal assertion crash via specially crafted retryable write commands, with the crash state durably written to disk so it survives server restarts. Affected releases span MongoDB 7.0.x through 7.0.40, 8.0.x through 8.0.29, and 8.3.x through 8.3.8; in sharded clusters the corrupted state can propagate across shard nodes, requiring manual DBA intervention to restore service. No public exploit has been identified and the vulnerability is not in CISA KEV, but the persistent, cluster-wide availability impact significantly elevates real-world risk beyond a transient service crash.
Authorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthenticated network attackers to perform arbitrary administrative operations. An improper case-sensitivity flaw (CWE-178) in the configuration validation component can cause the authorization subsystem to silently remain in its default disabled state during server startup, leaving the deployment wide open with no access controls enforced. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the impact is full compromise of data confidentiality, integrity, and availability.
Persistent denial-of-service in MongoDB Server (versions 7.0.x, 8.0.x, and 8.3.x) allows an authenticated user with collection creation privileges to corrupt durable storage metadata by supplying invalid storage configuration options that bypass validation in the storage engine integration layer. The malformed values are written to disk and trigger a fatal CWE-617 assertion failure when subsequent diagnostic operations attempt to read them back, crashing the server process. Because the corrupted metadata survives server restarts and is replicated to all replica set members via the oplog, a single attack can produce a cluster-wide outage requiring manual DBA intervention at the filesystem level on every affected node. No public exploit code or CISA KEV listing exists at time of analysis.
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by triggering a reachable assertion (CWE-617) in the read concern processing path. The flaw affects specific replica set member configurations across three MongoDB major release lines - 7.0.x, 8.0.x, and 8.3.x - and requires no credentials to exploit over the network. No public exploit code or active exploitation (CISA KEV) has been identified, but the zero-authentication, low-complexity network attack path makes this a meaningful availability risk for any organization running affected replica set deployments.
Direct storage-engine writes to arbitrary internal MongoDB tables are possible through an authorization bypass in the applyOps command affecting MongoDB Server 8.3.0 through 8.3.8. An authenticated user holding elevated internal MongoDB privileges can specify a client-inaccessible internal replication mode value, circumventing a disabled production feature gate and enabling container operations that are suppressed by default. Because the authorization check validates only the operation's namespace rather than the actual storage engine target, the attacker can route writes to unrelated internal metadata or other collections' data, potentially corrupting database state. No public exploit has been identified at time of analysis.
Use-after-free in MongoDB Server 8.3.x (versions 8.3.0 through 8.3.8) allows authenticated users holding read-only privileges to write to freed heap memory by issuing a specific sequence of standard database commands against the query execution memory tracking subsystem. The immediate consequence is a server process crash (denial of service); heap memory corruption may also enable more sophisticated follow-on exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available in 8.3.9.
Authenticated users holding readWrite privileges in MongoDB Server 7.0.x, 8.0.x, and 8.3.x can remotely crash the mongod server process by inserting a crafted BSON document. The vulnerability resides in the JSON Schema validation error generation path, which performs an unsafe numeric conversion on user-controlled BSON array field names without exception handling (CWE-248), causing an uncaught exception that terminates the server. No public exploit has been identified at time of analysis, though the attack path is explicitly described in the upstream advisory, lowering the bar for independent reproduction.
MongoDB Server 8.3.x exposes a type confusion (CWE-843) in its WiredTiger storage engine layer, allowing any authenticated user with readWrite privileges to crash the mongod process and keep it in a crash-loop. By creating a collection with a crafted, incompatible WiredTiger storage configuration option, the attacker causes the storage engine to misinterpret memory layout when subsequent reads are issued against that collection. Because the malicious collection configuration persists across server restarts, the denial-of-service condition is self-sustaining until an operator manually identifies and drops the offending collection. No public exploit or KEV listing has been identified at time of analysis.
Null pointer dereference in MongoDB Server 8.3.x crashes the mongod process when a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index. An authenticated user with write access can trigger an inconsistency in geometry parsing that leaves an internal object in a partially initialized state; subsequent index key generation then dereferences a null pointer and terminates the server. The net effect is a targeted denial of service requiring only a valid database account with write privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
MongoDB Server's JSON Pointer parser, invoked during $jsonSchema query filter processing, fails to enforce limits on iteration count or total allocation size, enabling authenticated remote attackers to cause significant memory amplification. Sending specially crafted find commands with malicious $jsonSchema filters - particularly under concurrent load - causes cumulative heap exhaustion that triggers MongoDB's out-of-memory handler, terminating the mongod process and denying service to all connected clients simultaneously. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Incorrect authorization in MongoDB Server's LDAP integration allows an authenticated user to acquire elevated privileges by exploiting stale identity retention in pooled LDAP connections. When LDAP-based authorization is configured and connection pooling is active, a reused connection may carry a prior user's LDAP identity into subsequent authorization queries, causing MongoDB to assign roles intended for a different directory principal. The result is unintended privilege escalation - a lower-privileged user may gain read or write access to data or administrative functions scoped to a higher-privileged LDAP group. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis.
MongoDB Server's $regexFindAll aggregation expression contains a reachable assertion (CWE-617) that any authenticated user with aggregation pipeline execution rights can trigger to crash the mongod process. When a regex match operation begins at a byte offset falling inside a multi-code-unit character - such as a multi-byte UTF-8 sequence or a Unicode surrogate pair - the internal invariant check fires and the database process terminates, causing a full denial of service for all connected clients. No public exploit code and no CISA KEV listing exist at time of analysis, but the triggering condition is deterministic and reproducible by any authenticated attacker who can submit crafted aggregation input.
Process-terminating denial of service in libmongocrypt's decryption path allows a low-privileged attacker to crash applications using MongoDB Client-Side Field Level Encryption (CSFLE). Tracked as MONGOCRYPT-971, the vulnerability is triggered when an unexpected-size encrypted value reaches the decryption routine, firing a reachable assertion (CWE-617) that abruptly terminates the host process rather than returning a handled error. An attacker who can store crafted encrypted values in a shared MongoDB collection, or influence the encrypted data an application receives, can repeatably crash the targeted application.
Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a trusted TLS endpoint to crash the connecting client application. During the TLS handshake, a server already trusted by the client can present specially crafted certificate data that triggers a heap object being freed twice (CWE-415), causing the client process to terminate unexpectedly. The impact is a client-side denial of service; no code execution has been claimed, and the CVSS 4.0 vector (VA:H, VC:N, VI:N) corroborates an availability-only outcome with no public exploit identified at time of analysis.
Stack-based buffer overflow in the MongoDB BI Connector ODBC driver allows a low-privileged SQL-capable user to overwrite adjacent stack memory by submitting a positioned-cursor statement with a cursor name exceeding the size of an internal fixed-length buffer. Any application exposing MongoDB through this ODBC driver - including common BI tools such as Tableau, Excel, or MicroStrategy - is affected across all currently listed versions (CPE wildcard). Successful exploitation can crash the hosting application process and may enable unintended code execution within that process context; no public exploit or CISA KEV listing is confirmed at time of analysis.
Unauthenticated connection exhaustion in MongoDB Connector for BI allows any network-reachable client to hold authentication sessions open indefinitely by initiating a SASL login exchange and then withholding further data. The absence of a wall-clock timeout on the negotiation loop and no read deadline on the client socket means each such session permanently occupies a worker thread, a connection slot, and associated backend MongoDB handles until the process is restarted. Sustained repetition of this pattern can exhaust the configured connection pool capacity entirely, denying service to all legitimate BI tool users; no public exploit has been identified at time of analysis.
Mongosqld in the MongoDB BI Connector requests but does not enforce client certificates during the TLS handshake when configured with a CA file, silently accepting connections from clients that present no certificate at all. Deployments that rely on client certificate authentication as the sole means of identifying users are fully exposed - any remote party with network access to the listener can establish a session and read all MongoDB data surfaced through the SQL interface. The CVSS 4.0 score of 8.7 reflects the network-accessible, zero-privilege nature of the flaw; no public exploit code or CISA KEV listing has been identified at time of analysis, and real-world impact is bounded by a specific non-default configuration prerequisite.
Log storage exhaustion in MongoDB Connector for BI (mongosqld) allows any unauthenticated network peer to crash the shared process by generating sufficient connection log volume to fill the configured log path's backing storage. When a subsequent log write or rotation operation fails, an uncaught exception (CWE-248) terminates the mongosqld process, immediately denying SQL service to all connected clients. The process cannot recover autonomously - it continues to fail on startup until an operator manually reclaims disk space - and the diagnostic message explaining the condition is never persisted, compounding operational triage difficulty. No active exploitation has been identified at time of analysis.
Schema-sampling denial-of-service in MongoDB Connector for BI allows a low-privileged database user to permanently halt the schema-refresh routine by creating a view in a sampled namespace that reliably fails on evaluation. The mongosqld process misclassifies the persistent failure as transient, exhausts its retry budget, then continues running with no valid schema - leaving all downstream SQL clients unable to retrieve results until an operator manually removes the offending view or excludes the namespace. No public exploit has been identified at time of analysis, but the low privilege requirement and network accessibility make this a credible insider or multi-tenant threat.
SQL injection via identifier escaping failure in MongoDB Connector for BI allows a low-privileged MongoDB user to craft collection, field, or index names that break out of SQL quoted identifiers, embedding arbitrary SQL into the DDL output produced by SHOW CREATE statements. Any user with write access to a sampled MongoDB collection can plant the payload; the injected SQL executes only when an operator or automated pipeline later replays that generated DDL against a downstream SQL-compatible server, triggering execution with that session's privileges. No public exploit has been identified and this CVE is not listed in CISA KEV, though the attack requires only low privileges and exploits a plausible - and often automated - operational workflow in analytics environments.
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress security-relevant MongoDB connection settings by embedding URL delimiter characters in user-supplied input. When an application passes untrusted text into the driver's connection-URL builder and the resulting string is re-parsed as authoritative client configuration, the injected delimiters are treated as structural URL syntax rather than literal data - allowing options such as TLS mode or authentication parameters to be overridden. No public exploit has been identified at time of analysis; vendor-confirmed patch is available as version 3.11.1 on NuGet.
Injection via unsanitized namespace identifiers in the MongoDB Rust Driver's Client::bulk_write operation allows an authenticated actor who can influence database or collection name arguments to redirect write operations to an unintended database within the same MongoDB deployment, using the application's own credentials. All versions of the mongodb crate prior to v3.8.2 are affected per vendor release notes; no public exploit or CISA KEV listing exists at time of analysis. The high integrity impact (VI:H in the CVSS 4.0 vector) reflects the potential for unauthorized modification of co-tenanted or privileged data across application-enforced logical boundaries.
Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected multi-tenant applications to redirect database operations to unintended namespaces. The driver fails to validate caller-supplied database and collection name identifiers against '.' and NUL byte characters, enabling an attacker who can influence those identifiers to access or modify another tenant's data. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in r4.5.1.
Namespace injection in MongoDB Go Driver's Client.BulkWrite API allows an attacker who controls the database name argument to redirect bulk write operations to an unintended database and collection. When an application passes untrusted, user-supplied input directly as a database name, the driver fails to escape reserved MongoDB namespace separator characters before constructing the target namespace string. The impact is a high-integrity write misdirection - data is silently written to attacker-influenced storage targets. No public exploit and no CISA KEV listing exist at time of analysis.
Unauthenticated remote process termination in MongoDB Connector for BI (mongosqld) affects deployments explicitly configured with Kerberos authentication. An attacker with network access to the mongosqld listener can send a crafted GSSAPI authentication exchange that triggers a double-free condition in error-handling code, crashing the process and interrupting BI availability until restarted. No public exploit code has been identified at time of analysis, and the attack is constrained to the subset of deployments running Kerberos - a non-default configuration.
Stack-based buffer overflow in the MongoDB BI Connector ODBC Driver setup dialog allows unintended code execution in the context of the user who opens the dialog. The flaw is triggered when a DSN configuration containing an over-length file path is loaded into the setup dialog and a file or folder selection is initiated, due to an incorrect buffer capacity calculation in that handler. No public exploit exists and no CISA KEV listing is present; however, a confirmed vendor-released patch is available in v1.4.9, which clamps DSN path field sizes.
Heap-based buffer overflow in the MongoDB BI Connector ODBC Driver enables process memory disclosure, process termination, or arbitrary code execution when an application processes crafted stored procedure output parameter metadata returned by a malicious or impersonated database server. All versions prior to v1.4.9 are affected (CPE: cpe:2.3:a:mongodb:bi_connector_odbc_driver:*:*:*:*:*:*:*:*), and the attack does not require privileges against the driver itself, though the attacker must control or impersonate the upstream database server. MongoDB has released a patched version (v1.4.9) that adds buffer-clamping logic to prevent the overflow; no public exploit has been identified at time of analysis.
Out-of-bounds write in the MongoDB BI Connector ODBC Driver allows an authenticated low-privileged user to crash the client application performing data reads through the connector. The driver fails to validate destination buffer size when converting floating-point column values to their string representations, enabling memory corruption when sufficiently large float values are encountered. No public exploit code has been identified at time of analysis, and a vendor-confirmed fix is available in version 1.4.9.
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or object name is passed to a metadata retrieval/catalog function, overflowing a fixed-size buffer. This can crash the calling application and, under certain heap/stack conditions, lead to arbitrary code execution within that process. The flaw is rooted in an integer overflow (CWE-190) in the driver's catalog-name handling; MongoDB itself reported it and shipped a clamp fix, and no public exploit has been identified at time of analysis (not listed in CISA KEV).
Out-of-bounds write in the MongoDB BI Connector ODBC Driver exposes client applications to memory corruption and potential code execution when the driver processes malformed stored procedure parameter metadata returned by a malicious or compromised server. The root cause is a missing bounds check (CWE-120) on the parameter size field in the metadata parsing routine, affecting all versions prior to v1.4.9. No public exploit code or active exploitation has been identified at time of analysis, and MongoDB has released a fix in v1.4.9.
Cleartext credential logging in the MongoDB Java Driver exposes outbound network connectivity credentials to any party with log read access during routine client initialization. Affected applications automatically write the credential to log output as part of normal operation - no special trigger, elevated privileges, or attacker interaction with the driver is required to produce the disclosure. While no public exploit or active exploitation has been confirmed, the CVSS 4.0 score of 8.2 reflects that recovered credentials can authenticate an attacker to separate network infrastructure beyond the affected application, producing a scope-changed confidentiality impact.
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to cause unauthorized modification or destruction of data in collections beyond their authorization scope. The flaw stems from insufficient validation of internal metadata namespace references during operations such as compaction, allowing a user scoped to one encrypted collection to trigger damaging actions against a logically separate collection. No public exploit has been identified and this vulnerability is absent from the CISA KEV catalog, but the high integrity and availability impact warrants urgent prioritization for any deployment leveraging the Queryable Encryption feature.
MongoDB Server's query execution engine contains a use-after-free condition (CWE-416) that authenticated users with read and write privileges can trigger by running specific queries against time-series collections. The dereferencing of a freed internal pointer results in either a full server crash - denying service to all connected clients - or partial disclosure of freed heap memory contents within query results. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the network-accessible, low-complexity attack path elevates practical urgency for deployments relying on time-series collections.
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue commands against protected system collections - such as system.users and system.roles - that their assigned privileges should explicitly prohibit. The flaw (CWE-863, Incorrect Authorization) means MongoDB's role-based access control enforcement is bypassed for certain actions on these collections, enabling the attacker to drop and recreate them without proper authorization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the potential to destroy authentication and role-definition data makes this a high-severity integrity and availability risk for any MongoDB deployment with multiple users.
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network attacker to force an authentication-mechanism downgrade during intra-cluster member-to-member connection setup, causing the shared internal keyfile/cluster credential to be sent in a weaker form that can be recovered. Any party with recovered credentials can authenticate as the internal superuser (__system) and gain full control of every node in the deployment. Reported by MongoDB (SERVER-130264); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds read in MongoDB Server's geospatial query processing permits an authenticated user with write privileges to store malformed geometry documents that bypass validation at ingestion time, with the memory access violation occurring later during query execution. Affected deployments span all tracked versions per NVD CPE data (cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:*), and the dual impact - server crash and limited process memory disclosure - makes this a moderate-to-high priority for any MongoDB deployment where untrusted authenticated users have write access. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in MongoDB Server's applyOps command allows authenticated users holding specific non-default privileges to perform data-definition operations - such as dropping or modifying collections - against collections they are not authorized to access. The flaw (CWE-863, Incorrect Authorization) stems from an inconsistency in collection resolution between the authorization check and the actual execution path within applyOps, a mechanism typically used for oplog replay and atomic multi-operation writes. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 7.0 with VI:H and VA:H signals meaningful data integrity and availability risk for deployments with shared or loosely governed privilege models.
MongoDB Server's query subsystem contains a type confusion flaw (CWE-843) that allows any authenticated user holding read privileges to crash the server process by submitting a specially formed query filter, resulting in a denial of service. The CVSS 4.0 score of 7.1 with VA:H and PR:L reflects the realistic threat: any legitimate database user - including service accounts or compromised low-privilege credentials - can take the database offline with no attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation bar warrants prompt patching once available.
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos router process by submitting a specially crafted aggregation command. The root cause is CWE-617 (Reachable Assertion), where attacker-controlled input triggers an internal assertion failure causing abnormal process termination. This affects sharded cluster deployments specifically - when mongos crashes, all client connections routed through that instance are severed, effectively taking down the database routing layer until the process is restarted. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent.
Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges to corrupt internal bucket data structures through crafted document insertions, then trigger out-of-bounds memory access via a subsequent insert. The impact spans denial of service via server crash, limited exposure of in-process memory contents, and memory corruption - all achievable without complex prerequisites beyond low-privilege authentication. No public exploit is identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects the high availability impact against a widely deployed database platform.
Atlas Vector Search in MongoDB Server exposes a horizontal authorization bypass allowing an authenticated low-privileged user to read documents from a view they are not authorized to access, crossing view-level access control boundaries within the same underlying collection. The flaw arises from MongoDB Server insufficiently validating user-supplied fields before forwarding internal requests to the search process, enabling the search backend to return documents outside the scope of the caller's authorized view. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in MongoDB Server's aggregation framework allows any authenticated read-only user to perform unauthorized write operations against collections they lack write access to. The root cause is an internal-use aggregation stage reachable by external clients without an authorization check on its embedded operations (CWE-862: Missing Authorization). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the low privilege bar makes any compromised or malicious read-only account a viable threat actor.
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level privileges to corrupt internal server memory, potentially crashing the server process or executing unintended code. The CVSS 4.0 score of 7.7 reflects a network-reachable vulnerability tempered by a low-privilege authentication requirement and a specific attack prerequisite (AT:P), indicating the flaw requires a particular lifecycle state in timeseries collections rather than a simple, reliable trigger. No public exploit code exists and this vulnerability has not been confirmed as actively exploited at time of analysis.
Out-of-bounds memory read in MongoDB Server's aggregation framework allows an authenticated attacker to crash the database server or expose limited memory contents by submitting a specially crafted numeric parameter within a specific aggregation pipeline stage. The CVSS 4.0 score of 7.1 reflects dual impact: high availability loss from server crash (VA:H) and low-level confidentiality exposure from adjacent memory leakage (VC:L). Self-reported by MongoDB (responsible disclosure), with no public exploit code or CISA KEV listing identified at time of analysis.
MongoDB Server crashes under certain authenticated query operations against time-series collections, allowing any low-privileged user with write access to terminate the mongod process and cause a denial of service. Affected across three active release lines (7.0, 8.0, 8.3), this flaw is rooted in CWE-617 (Reachable Assertion), where a malformed query predicate against a collection's metaField violates an internal invariant and aborts the server. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); vendor-released patches are available for all affected branches.
Queryable Encryption maintenance operations in MongoDB Server 8.0.x and 8.3.x fail to validate request parameters against the collection's encrypted field configuration due to an integer underflow (CWE-191), allowing an authenticated user with readWrite privileges to crash the server or induce excessive internal writes. The practical impact is availability loss and integrity degradation through corruption of encrypted index data - a particularly damaging outcome given that encrypted index corruption may be non-trivially recoverable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privilege user to crash the server or potentially execute unintended code by combining aggregation and memory-management commands in a way that causes a stale internal reference to be dereferenced after the underlying memory is freed. Affected versions are MongoDB Server 8.3.0 through 8.3.7; a vendor-released patch is available in 8.3.8. No public exploit code or CISA KEV listing has been identified at time of analysis, making this a high-severity but access-gated vulnerability.
Denial of service in MongoDB Server allows an authenticated user to crash the database process by submitting a query whose sort specification embeds a `$meta` expression in raw BSONObj form. Because query planning fails to explicitly handle the meta-expression case when reading the sort pattern, it performs an incorrect transformation that trips an internal invariant, terminating the mongod process. No public exploit identified at time of analysis; the issue is tracked in MongoDB's Jira as SERVER-128341 and reported by MongoDB's own CNA.
OS command injection in MongoDB Compass allows an attacker to smuggle a malicious 'browser open command' for the OIDC authentication flow into an importable connection file, a setting normally restricted to global Compass application settings and not editable through the connection form. When a victim imports the crafted connection and initiates OIDC authentication, the attacker-controlled command executes on the victim's host with the user's privileges. No public exploit identified at time of analysis, but the CVSS 4.0 base score is 8.4 (High) reflecting full compromise of confidentiality, integrity, and availability of the local system.
Out-of-bounds heap read in MongoDB Server's BSON CodeWScope element accessors lets an authenticated user disclose adjacent heap memory or crash the server (denial of service) by submitting a crafted aggregation pipeline. The exploit path abuses malformed BSONColumn (columnar/compressed BSON) data whose CodeWScope element bypasses the normal wire-level BSON validation, so an unchecked size field is trusted during decompression. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1, driven mainly by high availability impact.
Denial of service in MongoDB's aggregation framework allows an authenticated database user with write access to crash the mongod process by triggering a specific data type conversion operation that consumes disproportionate memory, causing the operating system's out-of-memory killer to terminate the process under memory pressure. Affected are MongoDB server deployments where low-privileged users can run aggregation queries; the CVSS 4.0 score is 7.1 with high availability impact and no confidentiality or integrity impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in MongoDB Server (mongod) allows an authenticated user with aggregation privileges to force the operating system to terminate the mongod process under memory pressure by abusing the $rankFusion and $scoreFusion hybrid-search aggregation stages. The flaw sits in the server's error-handling path and requires only the ability to run aggregation queries, causing an OOM-triggered crash of the database instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to crash the process (denial of service) or trigger undefined behavior by supplying maliciously crafted BSON data that is mishandled during aggregation pipeline processing (CWE-122 heap overflow). Only servers explicitly started in the non-default compute mode are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor rates it CVSS 4.0 9.2 (Critical) despite high attack complexity and a required precondition.
Denial of service in MongoDB's mongod server allows any authenticated user holding only read privileges to crash the database by submitting aggregation pipeline expressions that invoke server-side JavaScript, triggering a use-after-free (CWE-416) during document processing. The flaw affects availability only and requires valid low-privilege credentials; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in MongoDB Server allows an authenticated user to exhaust CPU or trigger out-of-memory conditions by submitting a crafted Queryable Encryption 'find' payload whose unvalidated field drives an internal computation loop. The resulting resource exhaustion degrades availability for all other operations on the affected instance. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is tracked internally as MongoDB SERVER-127566.
Improper authorization in MongoDB Server allows a local attacker holding a valid trusted-CA X.509 certificate to obtain unintended database roles when PROXY protocol v2 is used over the Unix domain socket, because certificate-derived roles bypass the configured tlsCATrusts allow-list during MONGODB-X509 authentication. An attacker with local access to the proxy socket can therefore escalate to roles they were never granted, compromising confidentiality and integrity of data. Tracked via MongoDB SERVER-128387 and rated CVSS 4.0 7.2 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Missing authorization in Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 allows unauthenticated REST API clients on MongoDB deployments to delete the internal _SCHEMA collection, stripping class field definitions, class-level permissions and protected fields so affected data becomes readable and modifiable by any client. PostgreSQL deployments are explicitly not affected and object ACLs continue to apply; no public exploit has been identified at time of analysis. The vendor and independent assessment rate this high severity (CVSS 8.8, assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and a near-term priority for MongoDB-backed installations with reachable REST endpoints; vendor patches are available for both affected release branches.
Client-side field-level encryption (CSFLE) in the MongoDB C# / .NET Driver before 3.13.0 can silently fail to encrypt fields that an application designated for protection, so data intended to be ciphertext is stored and returned in cleartext. The flaw sits in the schema-construction component that turns caller-supplied field identifiers into pattern expressions, so it only affects applications that build automatic-encryption schemas through the affected PatternProperty overload; the same defect can also make a rule apply more broadly than intended. Discovery requires no user interaction, and the party reading the unprotected values only needs ordinary authenticated read access to the stored data (PR:L in the assessed vector) - not the encryption keys - though it is not a default configuration and no public exploit was identified at time of analysis; the driver fixes it in 3.13.0.
Integrity-only NoSQL injection in the MongoDB C# Driver update-statement builder allows an authenticated application user with ordinary read-write access to influence update logic, potentially modifying or deleting stored data the application did not intend to change. The flaw is tracked as CSHARP-6168 and affects releases before 3.13.0; exploitation depends on the application passing attacker-influenced values directly into the affected update builder surface, so it is not reachable against a hardened application that does not do so. No public exploit was identified in the provided intelligence at time of analysis, and the primary remediation is upgrading to MongoDB .NET/C# Driver 3.13.0.
Identity impersonation in the MongoDB C#/.NET Driver allows one application user to execute database operations under another user's X.509 identity, affecting the confidentiality and integrity of everything that identity can reach. The driver's shared connection cache keys TLS client certificates only by issuer and serial number, so a user who copies a victim certificate's issuer and serial into their own certificate - without holding the victim's private key - can be handed a cached connection already authenticated as the victim. The flaw requires a specific multi-tenant architecture where one host application builds multiple clients from per-user certificates while sharing a connection pool; there is no public exploit identified at time of analysis, but the underlying patch is shipped in version 3.13.0.
NoSQL injection in MongoDB C# Driver before 3.13.0 lets an authenticated application user redirect LINQ-generated field paths by supplying dictionary keys, field names, or array-filter identifiers that contain dot or dollar characters. This can expose other users' documents, widen update operations beyond intended data, or write malformed fields that leave stored documents unreadable until repaired. The issue is a moderate-priority concern limited to applications that pass attacker-controllable input into field-name positions; no public exploit was identified at time of analysis, and it is fixed in driver 3.13.0.
Signals point to a real but bounded availability risk rather than a top-tier emergency: the MongoDB C# Driver's BSON library interns every BsonSymbol produced during deserialization and retains those symbols for the lifetime of the process with no cap, so an unauthenticated remote party able to get attacker-influenced BSON or JSON deserialized can drive unbounded memory growth and deny service to the host application (availability-only; assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, CNA CVSS 4.0 score 8.2). Exposure is conditional - the application must actually deserialize untrusted content through the driver and that content must carry BSON symbol values; merely having the driver installed is not a trigger, and no MongoDB server component is affected. No public exploit code or confirmed active exploitation has been identified at time of analysis; version 3.13.0 removes symbol interning as the fix.
MongoDB Compass before 14.9.15 can execute arbitrary code with the privileges of the user running Compass when that user connects to a MongoDB deployment containing a specially crafted stored view and opens that view for editing. The underlying issue is improper escaping of BSON values while Compass converts a view's aggregation pipeline into editable source, so attacker-controlled view definitions can break out into executable code. The assessed CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and no public exploit code or confirmed active exploitation was identified at time of analysis; exposure is concentrated in shared, hosted, or multi-tenant deployments where an attacker can create or modify views that a victim later opens.
MongoDB Server sharded clusters running versions 9.0 before 9.0.4 or 8.3.0 before 8.3.13 allow an authenticated user with write privileges on a regular collection to bypass authorization checks for internal system namespaces by submitting a bulk write operation through the mongos router. This incorrect authorization (CWE-863) can result in unauthorized writes to system namespaces, with an impact ranging from low integrity to high availability depending on the namespace targeted. No public exploit identified at time of analysis; vendor patches are available in MongoDB Server 9.0.4 and 8.3.13.
Null pointer dereference in MongoDB Server's collection validation feature enables an authenticated user with write access to crash the mongod process, producing a denial-of-service condition. The attacker must be able to create or modify a collection validator (for example via create or collMod with a validator document containing the mishandled expression); the crash is then triggered when a document is inserted into that collection and evaluated against the validator. Impact is limited to availability - no confidentiality or integrity loss - and the issue is most exploitable in shared or multi-tenant deployments where write and schema-validation privileges are broadly granted; no public exploit code was identified at time of analysis, and this is a moderate-severity availability issue rather than a widespread emergency.
Memory exhaustion in MongoDB Server lets an authenticated user with only read-only privileges crash the mongod process by running an aggregation query whose $match stage nests internal schema-validation operators against documents containing array fields. Because those operators are accepted in user-supplied query filters despite being intended for server-side $jsonSchema validation, the match expression evaluator expands every combination of array elements without an adequate resource limit, so memory grows until mongod is OOM-killed. Impact is availability only - no data disclosure or modification - and the issue requires an authenticated account (CVSS PR:L) plus the right document shape, so it is a genuine but moderate-priority DoS rather than an emergency; no public exploit code or confirmed active exploitation has been identified at time of analysis, and CVSS 4.0 scores it 7.1 (attack vector network, high availability impact).
Remote unauthenticated attackers can interfere with other clients' database writes in Parse Server versions 5.4.0 through 8.6.95 and 9.0.0 through 9.10.2-alpha.4 by exploiting a race condition in transactional batch request handling that shares state across concurrent requests. Successful exploitation requires a transaction-capable backend (PostgreSQL or MongoDB replica set/sharded cluster) and concurrent requests from multiple clients; it can lead to rollback of acknowledged writes and, on PostgreSQL, indefinitely open transactions that cause subsequent writes to fail. No public exploit code has been identified at the time of analysis, and the flaw is not confirmed as actively exploited.
Denial of service in the MongoDB Go Driver can be triggered when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte BSON array supplied by an unauthenticated remote source, causing an out-of-bounds index and a runtime panic that may terminate the unprotected process. The CVE carries a CVSS 4.0 base score of 8.2, but our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects the prerequisite that the vulnerable Validate methods must be invoked on attacker-controlled raw BSON; applications that never call these methods on untrusted input or that recover from panics are not materially impacted. No public exploit identified at time of analysis, no confidentiality or integrity impact has been identified, and the realistic blast radius is availability of the specific unprotected process.
Malformed BSON bytes fed to the MongoDB Go Driver can trigger an integer overflow in the driver's BSON value-length handling (CWE-190) and cause a runtime panic; because an unrecovered Go panic terminates the process, an unauthenticated remote attacker who can control BSON input reaching an application's validation or value-access path can cause a denial of service. The exposure is genuine but bounded: the driver's own server-monitoring path already contains panic recovery and degrades only to a server-selection failure, and applications that wrap BSON parsing in their own recovery, or never pass untrusted BSON into the driver, are not affected. No public exploit code has been identified at time of analysis, and no EPSS score was provided in the source data.
Memory corruption in MongoDB libmongocrypt lets an authenticated actor who can modify key vault documents - or a malicious or compromised MongoDB server - crash or corrupt the memory of any client application that has Client-Side Field Level Encryption (CSFLE) or Queryable Encryption enabled. The trigger is a crafted key document containing duplicate masterKey fields, which causes provider-specific KMS data to be mis-typed during key-document cleanup, producing invalid memory access and invalid frees (CWE-843 type confusion). Scored 8.7 under CVSS 4.0, while our own assessment is more conservative at CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H, placing the confirmed impact at client-side crash and memory corruption rather than proven remote code execution; no public exploit code identified at time of analysis, and exploitation requires that encryption be in use plus key-vault write privileges (PR:L) or a hostile server.
Denial of service in MongoDB libmongocrypt occurs when KMS endpoint parsing triggers an integer underflow, causing an allocation failure that terminates the application process. This can be triggered by an authenticated user with write access to the key vault collection modifying a key document, or when an application passes a KMS endpoint containing a colon after its path or query during key creation. No public exploit code has been identified at time of analysis, and the vulnerability does not allow code execution, data disclosure, or data tampering-only a crash.
Field-level write access control in the MongoDB adapter for Payload CMS (@payloadcms/db-mongodb) can be bypassed by an authenticated user who already holds document-update rights, allowing that user to write values into fields their role was explicitly configured to be unable to modify. Only MongoDB-backed deployments running @payloadcms/db-mongodb before 3.87.0, or canary builds before 4.0.0-canary.20, are affected - the Postgres and SQLite adapters are explicitly unaffected. There is no unauthenticated path and no public exploit identified at time of analysis, but the CVSS 3.1 base score is 7.1 (High, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) because the integrity impact of silently rewriting protected fields is severe once an attacker has any update-capable account.
An integer overflow in the BSON encoder of the MongoDB Python Driver's bundled native C extension (PyMongo before 4.18.2) can cause an out-of-bounds write inside the process hosting the driver when an application encodes a single document built from an unusually large (~2 GB) caller-supplied value. Only builds that link the C extension are affected - the pure-Python BSON fallback is not - and successfully triggering it requires that a large attacker-influenced value actually reach the encoding path, so most applications are exposed only through data they already accept from untrusted sources. The flaw is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; the vendor has released 4.18.2 as the fixed version, and because impact is confined to the hosting application's own process, risk is best treated as a genuine but precondition-heavy memory-corruption issue.
Attackers can inject arbitrary additional servers into a PyMongo (MongoDB Python Driver) client's connection topology by smuggling the percent-encoded form of a host-list delimiter (for example %2C) inside a hostname value that an application places into a connection string, because PyMongo decodes percent-escapes before it splits the host list. The request is unauthenticated (CVSS 4.0 PR:N) but carries an attack-requirement prerequisite (AT:P): the target application must build a URI at runtime from a host the attacker can influence, meaning static or hardcoded connection strings are not exploitable. MongoDB's own CVSS 4.0 rating of 8.3 (High) is driven by a high integrity impact - the client may route its authentication exchange and subsequent database operations to the rogue host, which can observe limited information and return altered query results. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in PyMongo 4.18.2.
Heap out-of-bounds write in the MongoDB C Driver (libmongoc) allows an unauthenticated attacker who controls DNS resolution and the responses of hosts in a client's connection string to corrupt memory and crash the application. Exploitation requires a privileged network position (MITM or rogue server) and results in denial of service, not code execution or data disclosure. Patched versions 1.30.12 and 2.5.5 are available; no public exploit code or active exploitation has been identified at time of analysis.
Code injection in MongoDB Compass lets an attacker who holds database-creation privileges on a MongoDB server interpolate unescaped shell syntax into the initial input of Compass's embedded MongoDB shell; when a victim user navigates to that database's view and explicitly opens the shell from it, the injected content is evaluated inside the Compass client process with that process's privileges. Exploitation is constrained: the attacker must be able to create databases on the connected server and name one maliciously, and the victim must perform the specific action of opening the shell for exactly that database, which is why the issue carries High attack complexity despite the 7.3 severity. Execution is confined to the Compass client process and does not reach the MongoDB server; Compass v1.49.12 is the fixed release, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Cache lock takeover in the MongoDB integration for Laravel (mongodb/laravel-mongodb) before 5.11.0 lets an authenticated user who can influence the lock 'owner' value hijack or prematurely expire a lock held by another process, producing duplicated or conflicting operations. The root cause is a NoSQL/aggregation-expression injection (CWE-943) in the MongoLock implementation, where a dollar-prefixed owner string such as '$owner', '$literal' or '$$ROOT' is evaluated by MongoDB as an aggregation expression instead of being treated as a literal value. CVSS 7.1 (VI:H, VA:L, no confidentiality or scope impact) places this as a genuine but moderate integrity-focused flaw: it only affects deployments using the MongoDB cache-lock backend on pre-5.11.0 versions, exploitability depends on the application deriving lock owner values from user-influenced input (not the standard usage pattern), and no public exploit code has been identified at time of analysis.
Race condition in MongoDB Server's document value layer permits an authenticated user with ordinary read-write database privileges to trigger unsynchronized concurrent thread access to shared internal memory over the standard client protocol, leading to server termination and potential corruption of process memory with user-influenced content. The flaw affects confidentiality, integrity, and availability of the MongoDB server process - worst-case outcomes range from a reliable denial-of-service crash loop to a write primitive enabling memory disclosure or data manipulation. No public exploit has been identified at time of analysis, and the race condition's timing dependency (AT:P in the CVSS 4.0 vector) moderates reliable exploitability despite the high theoretical impact.
Use-after-free in the reactive client-side encryption component of the MongoDB Java Driver allows a party that can cancel an in-flight encrypted operation to crash the hosting application process. The flaw surfaces only when the reactive encryption stack is active and KMS credentials are fetched on demand - a specific non-default configuration - making the affected population a subset of all Java Driver deployments. No public exploit code or active exploitation has been identified at time of analysis; impact is confined to availability (process termination), with no confidentiality or integrity consequence.
NoSQL injection in the MongoDB integration for Laravel (laravel-mongodb PHP) allows an authenticated low-privilege user to manipulate polymorphic relation identifiers, causing the application to return documents outside the intended relation target. The vulnerability (CWE-943) exploits the boundary between data and query logic in MongoDB's operator-based query model: a crafted relation identifier stored by an attacker is later interpreted as a MongoDB query condition rather than a literal string during relation resolution. No active exploitation has been identified, and no public proof-of-concept is known at time of analysis; the issue is tracked in MongoDB JIRA as PHPLARA-265.
NoSQL injection in the MongoDB-Laravel PHP integration's embedded-document relation handling allows an authenticated low-privilege user to manipulate embedded record identifiers so they are evaluated as query operators rather than literal values. Exploitation can result in mass deletion of all embedded documents within a targeted parent record, or silent overwrite of an unintended embedded document, depending on how the injected condition is constructed. No public exploit code has been identified at time of analysis, and no CISA KEV entry exists, but the network-accessible attack surface and low authentication barrier make this a meaningful integrity risk for any application exposing user-controlled identifiers to embedded-relation operations.
Regex metacharacter injection in the MongoDB C# Driver's LINQ query translation layer allows an authenticated low-privilege user to alter generated regular-expression predicates, causing the application to return database records beyond those the original filter was designed to expose. The vulnerability, reported by MongoDB and tracked under CSHARP-6177 (CWE-943), requires only network access and a low-privilege account - making it a meaningful access-control risk in any .NET application that incorporates user input into LINQ regex-based queries against MongoDB. No public exploit has been identified at time of analysis, and no EPSS or KEV data is present in available intelligence.
NoSQL injection in the MongoDB integration for Laravel PHP allows a remote unauthenticated attacker to subvert equality filter operations across three specific API code paths. When user-controlled input delivers an operator-shaped array to the `where` (equality), `find`, or `delete` methods, MongoDB interprets the array as a query condition rather than a literal value - enabling unauthorized document reads and out-of-scope document deletion. No confirmed active exploitation or public exploit code exists at time of analysis, but the integrity and availability impacts (VI:H, VA:H in CVSS 4.0) are severe given that bulk or arbitrary document deletion may be irreversible.
MongoDB Server's query planning component harbors a CWE-190 integer overflow that enables an authenticated database user with ordinary read/write privileges to crash the entire server node via a specially crafted query. The overflow bypasses an internal resource limit during query planning, triggering unbounded memory consumption that terminates the server process and denies service to all databases hosted on that node. Affected release lines are 7.0.x (below 7.0.41), 8.0.x (below 8.0.30), and 8.3.x (below 8.3.9); MongoDB has released patches for all three; no public exploit or CISA KEV listing was identified at time of analysis.
Unauthenticated CPU exhaustion in the MongoDB sharded-cluster router process (mongos) allows any client with network access to a router port to supply crafted connection-monitoring parameters that consume unbounded server CPU, degrading or denying service to legitimate clients. The flaw is restricted to sharded deployments running mongos - standalone or replica-set-only mongod instances are not in scope. No authentication, privileges, or user interaction are required; only availability is affected, with no confidentiality or integrity impact. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Incorrect authorization in MongoDB Server's aggregation framework allows an authenticated low-privilege user to craft a specially formatted aggregation request that causes the authorization subsystem to evaluate a different operation than what the execution engine actually runs, resulting in unauthorized read access to collection data within the target database. Affected versions span MongoDB Server 7.0.0-7.0.40 and 8.0.0-8.0.29; vendor-released patches are available at 7.0.41 and 8.0.30 respectively. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low privilege requirement and network accessibility elevate the realistic threat in multi-tenant or role-segregated MongoDB deployments.
MongoDB Server 8.3.0-8.3.8 exposes an authorization bypass in the aggregation framework that allows a low-privilege authenticated user to read data from collections they are not authorized to access. The bypass is reachable only when Atlas Search features are active and works by manipulating an internal command parameter that the server failed to guard from external client input, causing a view-level security check to be skipped. No public exploit code has been identified at time of analysis, and exploitation requires an authenticated account.
Out-of-bounds memory write in MongoDB Server 8.3.x allows authenticated users with write privileges to crash the mongod server process or potentially achieve arbitrary code execution by supplying crafted storage engine configuration parameters at collection creation time. Versions 8.3.0 through 8.3.8 are affected; a vendor-released fix is available in 8.3.9. No public exploit code or confirmed active exploitation has been identified at time of analysis.
MongoDB Server's diagnostic reporting interface exposes cleartext credentials from in-flight administrative operations to any authenticated user holding monitoring-level privileges, creating a lateral-movement and privilege-escalation path via impersonation of higher-privileged accounts. Affected versions span the 7.0.x branch (before 7.0.41), 8.0.x branch (before 8.0.30), and 8.3.x branch (before 8.3.9). The server's log subsystem correctly redacts credential material, but an equivalent sanitization pass is absent from the diagnostic interface's serialization path, producing an inconsistent security boundary across two observability outputs for the same underlying data.
Persistent denial-of-service in MongoDB Server allows any authenticated user with write privileges to trigger a fatal assertion crash via specially crafted retryable write commands, with the crash state durably written to disk so it survives server restarts. Affected releases span MongoDB 7.0.x through 7.0.40, 8.0.x through 8.0.29, and 8.3.x through 8.3.8; in sharded clusters the corrupted state can propagate across shard nodes, requiring manual DBA intervention to restore service. No public exploit has been identified and the vulnerability is not in CISA KEV, but the persistent, cluster-wide availability impact significantly elevates real-world risk beyond a transient service crash.
Authorization bypass in MongoDB Server (7.0.x before 7.0.41, 8.0.x before 8.0.30, 8.3.x before 8.3.9) allows unauthenticated network attackers to perform arbitrary administrative operations. An improper case-sensitivity flaw (CWE-178) in the configuration validation component can cause the authorization subsystem to silently remain in its default disabled state during server startup, leaving the deployment wide open with no access controls enforced. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the impact is full compromise of data confidentiality, integrity, and availability.
Persistent denial-of-service in MongoDB Server (versions 7.0.x, 8.0.x, and 8.3.x) allows an authenticated user with collection creation privileges to corrupt durable storage metadata by supplying invalid storage configuration options that bypass validation in the storage engine integration layer. The malformed values are written to disk and trigger a fatal CWE-617 assertion failure when subsequent diagnostic operations attempt to read them back, crashing the server process. Because the corrupted metadata survives server restarts and is replicated to all replica set members via the oplog, a single attack can produce a cluster-wide outage requiring manual DBA intervention at the filesystem level on every affected node. No public exploit code or CISA KEV listing exists at time of analysis.
Denial of service in MongoDB Server allows an unauthenticated remote attacker to terminate the mongod process by triggering a reachable assertion (CWE-617) in the read concern processing path. The flaw affects specific replica set member configurations across three MongoDB major release lines - 7.0.x, 8.0.x, and 8.3.x - and requires no credentials to exploit over the network. No public exploit code or active exploitation (CISA KEV) has been identified, but the zero-authentication, low-complexity network attack path makes this a meaningful availability risk for any organization running affected replica set deployments.
Direct storage-engine writes to arbitrary internal MongoDB tables are possible through an authorization bypass in the applyOps command affecting MongoDB Server 8.3.0 through 8.3.8. An authenticated user holding elevated internal MongoDB privileges can specify a client-inaccessible internal replication mode value, circumventing a disabled production feature gate and enabling container operations that are suppressed by default. Because the authorization check validates only the operation's namespace rather than the actual storage engine target, the attacker can route writes to unrelated internal metadata or other collections' data, potentially corrupting database state. No public exploit has been identified at time of analysis.
Use-after-free in MongoDB Server 8.3.x (versions 8.3.0 through 8.3.8) allows authenticated users holding read-only privileges to write to freed heap memory by issuing a specific sequence of standard database commands against the query execution memory tracking subsystem. The immediate consequence is a server process crash (denial of service); heap memory corruption may also enable more sophisticated follow-on exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor-released patch is available in 8.3.9.
Authenticated users holding readWrite privileges in MongoDB Server 7.0.x, 8.0.x, and 8.3.x can remotely crash the mongod server process by inserting a crafted BSON document. The vulnerability resides in the JSON Schema validation error generation path, which performs an unsafe numeric conversion on user-controlled BSON array field names without exception handling (CWE-248), causing an uncaught exception that terminates the server. No public exploit has been identified at time of analysis, though the attack path is explicitly described in the upstream advisory, lowering the bar for independent reproduction.
MongoDB Server 8.3.x exposes a type confusion (CWE-843) in its WiredTiger storage engine layer, allowing any authenticated user with readWrite privileges to crash the mongod process and keep it in a crash-loop. By creating a collection with a crafted, incompatible WiredTiger storage configuration option, the attacker causes the storage engine to misinterpret memory layout when subsequent reads are issued against that collection. Because the malicious collection configuration persists across server restarts, the denial-of-service condition is self-sustaining until an operator manually identifies and drops the offending collection. No public exploit or KEV listing has been identified at time of analysis.
Null pointer dereference in MongoDB Server 8.3.x crashes the mongod process when a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index. An authenticated user with write access can trigger an inconsistency in geometry parsing that leaves an internal object in a partially initialized state; subsequent index key generation then dereferences a null pointer and terminates the server. The net effect is a targeted denial of service requiring only a valid database account with write privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
MongoDB Server's JSON Pointer parser, invoked during $jsonSchema query filter processing, fails to enforce limits on iteration count or total allocation size, enabling authenticated remote attackers to cause significant memory amplification. Sending specially crafted find commands with malicious $jsonSchema filters - particularly under concurrent load - causes cumulative heap exhaustion that triggers MongoDB's out-of-memory handler, terminating the mongod process and denying service to all connected clients simultaneously. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Incorrect authorization in MongoDB Server's LDAP integration allows an authenticated user to acquire elevated privileges by exploiting stale identity retention in pooled LDAP connections. When LDAP-based authorization is configured and connection pooling is active, a reused connection may carry a prior user's LDAP identity into subsequent authorization queries, causing MongoDB to assign roles intended for a different directory principal. The result is unintended privilege escalation - a lower-privileged user may gain read or write access to data or administrative functions scoped to a higher-privileged LDAP group. No public exploit code exists and this CVE is not listed in CISA KEV at time of analysis.
MongoDB Server's $regexFindAll aggregation expression contains a reachable assertion (CWE-617) that any authenticated user with aggregation pipeline execution rights can trigger to crash the mongod process. When a regex match operation begins at a byte offset falling inside a multi-code-unit character - such as a multi-byte UTF-8 sequence or a Unicode surrogate pair - the internal invariant check fires and the database process terminates, causing a full denial of service for all connected clients. No public exploit code and no CISA KEV listing exist at time of analysis, but the triggering condition is deterministic and reproducible by any authenticated attacker who can submit crafted aggregation input.
Process-terminating denial of service in libmongocrypt's decryption path allows a low-privileged attacker to crash applications using MongoDB Client-Side Field Level Encryption (CSFLE). Tracked as MONGOCRYPT-971, the vulnerability is triggered when an unexpected-size encrypted value reaches the decryption routine, firing a reachable assertion (CWE-617) that abruptly terminates the host process rather than returning a handled error. An attacker who can store crafted encrypted values in a shared MongoDB collection, or influence the encrypted data an application receives, can repeatably crash the targeted application.
Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a trusted TLS endpoint to crash the connecting client application. During the TLS handshake, a server already trusted by the client can present specially crafted certificate data that triggers a heap object being freed twice (CWE-415), causing the client process to terminate unexpectedly. The impact is a client-side denial of service; no code execution has been claimed, and the CVSS 4.0 vector (VA:H, VC:N, VI:N) corroborates an availability-only outcome with no public exploit identified at time of analysis.
Stack-based buffer overflow in the MongoDB BI Connector ODBC driver allows a low-privileged SQL-capable user to overwrite adjacent stack memory by submitting a positioned-cursor statement with a cursor name exceeding the size of an internal fixed-length buffer. Any application exposing MongoDB through this ODBC driver - including common BI tools such as Tableau, Excel, or MicroStrategy - is affected across all currently listed versions (CPE wildcard). Successful exploitation can crash the hosting application process and may enable unintended code execution within that process context; no public exploit or CISA KEV listing is confirmed at time of analysis.
Unauthenticated connection exhaustion in MongoDB Connector for BI allows any network-reachable client to hold authentication sessions open indefinitely by initiating a SASL login exchange and then withholding further data. The absence of a wall-clock timeout on the negotiation loop and no read deadline on the client socket means each such session permanently occupies a worker thread, a connection slot, and associated backend MongoDB handles until the process is restarted. Sustained repetition of this pattern can exhaust the configured connection pool capacity entirely, denying service to all legitimate BI tool users; no public exploit has been identified at time of analysis.
Mongosqld in the MongoDB BI Connector requests but does not enforce client certificates during the TLS handshake when configured with a CA file, silently accepting connections from clients that present no certificate at all. Deployments that rely on client certificate authentication as the sole means of identifying users are fully exposed - any remote party with network access to the listener can establish a session and read all MongoDB data surfaced through the SQL interface. The CVSS 4.0 score of 8.7 reflects the network-accessible, zero-privilege nature of the flaw; no public exploit code or CISA KEV listing has been identified at time of analysis, and real-world impact is bounded by a specific non-default configuration prerequisite.
Log storage exhaustion in MongoDB Connector for BI (mongosqld) allows any unauthenticated network peer to crash the shared process by generating sufficient connection log volume to fill the configured log path's backing storage. When a subsequent log write or rotation operation fails, an uncaught exception (CWE-248) terminates the mongosqld process, immediately denying SQL service to all connected clients. The process cannot recover autonomously - it continues to fail on startup until an operator manually reclaims disk space - and the diagnostic message explaining the condition is never persisted, compounding operational triage difficulty. No active exploitation has been identified at time of analysis.
Schema-sampling denial-of-service in MongoDB Connector for BI allows a low-privileged database user to permanently halt the schema-refresh routine by creating a view in a sampled namespace that reliably fails on evaluation. The mongosqld process misclassifies the persistent failure as transient, exhausts its retry budget, then continues running with no valid schema - leaving all downstream SQL clients unable to retrieve results until an operator manually removes the offending view or excludes the namespace. No public exploit has been identified at time of analysis, but the low privilege requirement and network accessibility make this a credible insider or multi-tenant threat.
SQL injection via identifier escaping failure in MongoDB Connector for BI allows a low-privileged MongoDB user to craft collection, field, or index names that break out of SQL quoted identifiers, embedding arbitrary SQL into the DDL output produced by SHOW CREATE statements. Any user with write access to a sampled MongoDB collection can plant the payload; the injected SQL executes only when an operator or automated pipeline later replays that generated DDL against a downstream SQL-compatible server, triggering execution with that session's privileges. No public exploit has been identified and this CVE is not listed in CISA KEV, though the attack requires only low privileges and exploits a plausible - and often automated - operational workflow in analytics environments.
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress security-relevant MongoDB connection settings by embedding URL delimiter characters in user-supplied input. When an application passes untrusted text into the driver's connection-URL builder and the resulting string is re-parsed as authoritative client configuration, the injected delimiters are treated as structural URL syntax rather than literal data - allowing options such as TLS mode or authentication parameters to be overridden. No public exploit has been identified at time of analysis; vendor-confirmed patch is available as version 3.11.1 on NuGet.
Injection via unsanitized namespace identifiers in the MongoDB Rust Driver's Client::bulk_write operation allows an authenticated actor who can influence database or collection name arguments to redirect write operations to an unintended database within the same MongoDB deployment, using the application's own credentials. All versions of the mongodb crate prior to v3.8.2 are affected per vendor release notes; no public exploit or CISA KEV listing exists at time of analysis. The high integrity impact (VI:H in the CVSS 4.0 vector) reflects the potential for unauthorized modification of co-tenanted or privileged data across application-enforced logical boundaries.
Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected multi-tenant applications to redirect database operations to unintended namespaces. The driver fails to validate caller-supplied database and collection name identifiers against '.' and NUL byte characters, enabling an attacker who can influence those identifiers to access or modify another tenant's data. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in r4.5.1.
Namespace injection in MongoDB Go Driver's Client.BulkWrite API allows an attacker who controls the database name argument to redirect bulk write operations to an unintended database and collection. When an application passes untrusted, user-supplied input directly as a database name, the driver fails to escape reserved MongoDB namespace separator characters before constructing the target namespace string. The impact is a high-integrity write misdirection - data is silently written to attacker-influenced storage targets. No public exploit and no CISA KEV listing exist at time of analysis.
Unauthenticated remote process termination in MongoDB Connector for BI (mongosqld) affects deployments explicitly configured with Kerberos authentication. An attacker with network access to the mongosqld listener can send a crafted GSSAPI authentication exchange that triggers a double-free condition in error-handling code, crashing the process and interrupting BI availability until restarted. No public exploit code has been identified at time of analysis, and the attack is constrained to the subset of deployments running Kerberos - a non-default configuration.
Stack-based buffer overflow in the MongoDB BI Connector ODBC Driver setup dialog allows unintended code execution in the context of the user who opens the dialog. The flaw is triggered when a DSN configuration containing an over-length file path is loaded into the setup dialog and a file or folder selection is initiated, due to an incorrect buffer capacity calculation in that handler. No public exploit exists and no CISA KEV listing is present; however, a confirmed vendor-released patch is available in v1.4.9, which clamps DSN path field sizes.
Heap-based buffer overflow in the MongoDB BI Connector ODBC Driver enables process memory disclosure, process termination, or arbitrary code execution when an application processes crafted stored procedure output parameter metadata returned by a malicious or impersonated database server. All versions prior to v1.4.9 are affected (CPE: cpe:2.3:a:mongodb:bi_connector_odbc_driver:*:*:*:*:*:*:*:*), and the attack does not require privileges against the driver itself, though the attacker must control or impersonate the upstream database server. MongoDB has released a patched version (v1.4.9) that adds buffer-clamping logic to prevent the overflow; no public exploit has been identified at time of analysis.
Out-of-bounds write in the MongoDB BI Connector ODBC Driver allows an authenticated low-privileged user to crash the client application performing data reads through the connector. The driver fails to validate destination buffer size when converting floating-point column values to their string representations, enabling memory corruption when sufficiently large float values are encountered. No public exploit code has been identified at time of analysis, and a vendor-confirmed fix is available in version 1.4.9.
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or object name is passed to a metadata retrieval/catalog function, overflowing a fixed-size buffer. This can crash the calling application and, under certain heap/stack conditions, lead to arbitrary code execution within that process. The flaw is rooted in an integer overflow (CWE-190) in the driver's catalog-name handling; MongoDB itself reported it and shipped a clamp fix, and no public exploit has been identified at time of analysis (not listed in CISA KEV).
Out-of-bounds write in the MongoDB BI Connector ODBC Driver exposes client applications to memory corruption and potential code execution when the driver processes malformed stored procedure parameter metadata returned by a malicious or compromised server. The root cause is a missing bounds check (CWE-120) on the parameter size field in the metadata parsing routine, affecting all versions prior to v1.4.9. No public exploit code or active exploitation has been identified at time of analysis, and MongoDB has released a fix in v1.4.9.
Cleartext credential logging in the MongoDB Java Driver exposes outbound network connectivity credentials to any party with log read access during routine client initialization. Affected applications automatically write the credential to log output as part of normal operation - no special trigger, elevated privileges, or attacker interaction with the driver is required to produce the disclosure. While no public exploit or active exploitation has been confirmed, the CVSS 4.0 score of 8.2 reflects that recovered credentials can authenticate an attacker to separate network infrastructure beyond the affected application, producing a scope-changed confidentiality impact.
Queryable Encryption maintenance operations in MongoDB Server permit an authenticated low-privileged database user to cause unauthorized modification or destruction of data in collections beyond their authorization scope. The flaw stems from insufficient validation of internal metadata namespace references during operations such as compaction, allowing a user scoped to one encrypted collection to trigger damaging actions against a logically separate collection. No public exploit has been identified and this vulnerability is absent from the CISA KEV catalog, but the high integrity and availability impact warrants urgent prioritization for any deployment leveraging the Queryable Encryption feature.
MongoDB Server's query execution engine contains a use-after-free condition (CWE-416) that authenticated users with read and write privileges can trigger by running specific queries against time-series collections. The dereferencing of a freed internal pointer results in either a full server crash - denying service to all connected clients - or partial disclosure of freed heap memory contents within query results. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the network-accessible, low-complexity attack path elevates practical urgency for deployments relying on time-series collections.
Authorization bypass in MongoDB Server allows an authenticated user holding only a limited database-scoped role to issue commands against protected system collections - such as system.users and system.roles - that their assigned privileges should explicitly prohibit. The flaw (CWE-863, Incorrect Authorization) means MongoDB's role-based access control enforcement is bypassed for certain actions on these collections, enabling the attacker to drop and recreate them without proper authorization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the potential to destroy authentication and role-definition data makes this a high-severity integrity and availability risk for any MongoDB deployment with multiple users.
Credential exposure in MongoDB Server's replica-set/sharded-cluster internal authentication allows an adjacent-network attacker to force an authentication-mechanism downgrade during intra-cluster member-to-member connection setup, causing the shared internal keyfile/cluster credential to be sent in a weaker form that can be recovered. Any party with recovered credentials can authenticate as the internal superuser (__system) and gain full control of every node in the deployment. Reported by MongoDB (SERVER-130264); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds read in MongoDB Server's geospatial query processing permits an authenticated user with write privileges to store malformed geometry documents that bypass validation at ingestion time, with the memory access violation occurring later during query execution. Affected deployments span all tracked versions per NVD CPE data (cpe:2.3:a:mongodb:mongodb_server:*:*:*:*:*:*:*:*), and the dual impact - server crash and limited process memory disclosure - makes this a moderate-to-high priority for any MongoDB deployment where untrusted authenticated users have write access. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in MongoDB Server's applyOps command allows authenticated users holding specific non-default privileges to perform data-definition operations - such as dropping or modifying collections - against collections they are not authorized to access. The flaw (CWE-863, Incorrect Authorization) stems from an inconsistency in collection resolution between the authorization check and the actual execution path within applyOps, a mechanism typically used for oplog replay and atomic multi-operation writes. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 7.0 with VI:H and VA:H signals meaningful data integrity and availability risk for deployments with shared or loosely governed privilege models.
MongoDB Server's query subsystem contains a type confusion flaw (CWE-843) that allows any authenticated user holding read privileges to crash the server process by submitting a specially formed query filter, resulting in a denial of service. The CVSS 4.0 score of 7.1 with VA:H and PR:L reflects the realistic threat: any legitimate database user - including service accounts or compromised low-privilege credentials - can take the database offline with no attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation bar warrants prompt patching once available.
Unauthenticated denial of service in MongoDB Server's aggregation framework allows remote attackers to crash the mongos router process by submitting a specially crafted aggregation command. The root cause is CWE-617 (Reachable Assertion), where attacker-controlled input triggers an internal assertion failure causing abnormal process termination. This affects sharded cluster deployments specifically - when mongos crashes, all client connections routed through that instance are severed, effectively taking down the database routing layer until the process is restarted. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent.
Memory corruption in MongoDB Server's timeseries collection handling allows an authenticated user with write privileges to corrupt internal bucket data structures through crafted document insertions, then trigger out-of-bounds memory access via a subsequent insert. The impact spans denial of service via server crash, limited exposure of in-process memory contents, and memory corruption - all achievable without complex prerequisites beyond low-privilege authentication. No public exploit is identified at time of analysis, but the CVSS 4.0 score of 7.2 reflects the high availability impact against a widely deployed database platform.
Atlas Vector Search in MongoDB Server exposes a horizontal authorization bypass allowing an authenticated low-privileged user to read documents from a view they are not authorized to access, crossing view-level access control boundaries within the same underlying collection. The flaw arises from MongoDB Server insufficiently validating user-supplied fields before forwarding internal requests to the search process, enabling the search backend to return documents outside the scope of the caller's authorized view. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in MongoDB Server's aggregation framework allows any authenticated read-only user to perform unauthorized write operations against collections they lack write access to. The root cause is an internal-use aggregation stage reachable by external clients without an authorization check on its embedded operations (CWE-862: Missing Authorization). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the low privilege bar makes any compromised or malicious read-only account a viable threat actor.
Use-after-free in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write-level privileges to corrupt internal server memory, potentially crashing the server process or executing unintended code. The CVSS 4.0 score of 7.7 reflects a network-reachable vulnerability tempered by a low-privilege authentication requirement and a specific attack prerequisite (AT:P), indicating the flaw requires a particular lifecycle state in timeseries collections rather than a simple, reliable trigger. No public exploit code exists and this vulnerability has not been confirmed as actively exploited at time of analysis.
Out-of-bounds memory read in MongoDB Server's aggregation framework allows an authenticated attacker to crash the database server or expose limited memory contents by submitting a specially crafted numeric parameter within a specific aggregation pipeline stage. The CVSS 4.0 score of 7.1 reflects dual impact: high availability loss from server crash (VA:H) and low-level confidentiality exposure from adjacent memory leakage (VC:L). Self-reported by MongoDB (responsible disclosure), with no public exploit code or CISA KEV listing identified at time of analysis.
MongoDB Server crashes under certain authenticated query operations against time-series collections, allowing any low-privileged user with write access to terminate the mongod process and cause a denial of service. Affected across three active release lines (7.0, 8.0, 8.3), this flaw is rooted in CWE-617 (Reachable Assertion), where a malformed query predicate against a collection's metaField violates an internal invariant and aborts the server. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); vendor-released patches are available for all affected branches.
Queryable Encryption maintenance operations in MongoDB Server 8.0.x and 8.3.x fail to validate request parameters against the collection's encrypted field configuration due to an integer underflow (CWE-191), allowing an authenticated user with readWrite privileges to crash the server or induce excessive internal writes. The practical impact is availability loss and integrity degradation through corruption of encrypted index data - a particularly damaging outcome given that encrypted index corruption may be non-trivially recoverable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free memory corruption in MongoDB Server's $graphLookup aggregation stage allows an authenticated high-privilege user to crash the server or potentially execute unintended code by combining aggregation and memory-management commands in a way that causes a stale internal reference to be dereferenced after the underlying memory is freed. Affected versions are MongoDB Server 8.3.0 through 8.3.7; a vendor-released patch is available in 8.3.8. No public exploit code or CISA KEV listing has been identified at time of analysis, making this a high-severity but access-gated vulnerability.
Denial of service in MongoDB Server allows an authenticated user to crash the database process by submitting a query whose sort specification embeds a `$meta` expression in raw BSONObj form. Because query planning fails to explicitly handle the meta-expression case when reading the sort pattern, it performs an incorrect transformation that trips an internal invariant, terminating the mongod process. No public exploit identified at time of analysis; the issue is tracked in MongoDB's Jira as SERVER-128341 and reported by MongoDB's own CNA.
OS command injection in MongoDB Compass allows an attacker to smuggle a malicious 'browser open command' for the OIDC authentication flow into an importable connection file, a setting normally restricted to global Compass application settings and not editable through the connection form. When a victim imports the crafted connection and initiates OIDC authentication, the attacker-controlled command executes on the victim's host with the user's privileges. No public exploit identified at time of analysis, but the CVSS 4.0 base score is 8.4 (High) reflecting full compromise of confidentiality, integrity, and availability of the local system.
Out-of-bounds heap read in MongoDB Server's BSON CodeWScope element accessors lets an authenticated user disclose adjacent heap memory or crash the server (denial of service) by submitting a crafted aggregation pipeline. The exploit path abuses malformed BSONColumn (columnar/compressed BSON) data whose CodeWScope element bypasses the normal wire-level BSON validation, so an unchecked size field is trusted during decompression. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1, driven mainly by high availability impact.
Denial of service in MongoDB's aggregation framework allows an authenticated database user with write access to crash the mongod process by triggering a specific data type conversion operation that consumes disproportionate memory, causing the operating system's out-of-memory killer to terminate the process under memory pressure. Affected are MongoDB server deployments where low-privileged users can run aggregation queries; the CVSS 4.0 score is 7.1 with high availability impact and no confidentiality or integrity impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in MongoDB Server (mongod) allows an authenticated user with aggregation privileges to force the operating system to terminate the mongod process under memory pressure by abusing the $rankFusion and $scoreFusion hybrid-search aggregation stages. The flaw sits in the server's error-handling path and requires only the ability to run aggregation queries, causing an OOM-triggered crash of the database instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to crash the process (denial of service) or trigger undefined behavior by supplying maliciously crafted BSON data that is mishandled during aggregation pipeline processing (CWE-122 heap overflow). Only servers explicitly started in the non-default compute mode are affected. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the vendor rates it CVSS 4.0 9.2 (Critical) despite high attack complexity and a required precondition.
Denial of service in MongoDB's mongod server allows any authenticated user holding only read privileges to crash the database by submitting aggregation pipeline expressions that invoke server-side JavaScript, triggering a use-after-free (CWE-416) during document processing. The flaw affects availability only and requires valid low-privilege credentials; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in MongoDB Server allows an authenticated user to exhaust CPU or trigger out-of-memory conditions by submitting a crafted Queryable Encryption 'find' payload whose unvalidated field drives an internal computation loop. The resulting resource exhaustion degrades availability for all other operations on the affected instance. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is tracked internally as MongoDB SERVER-127566.
Improper authorization in MongoDB Server allows a local attacker holding a valid trusted-CA X.509 certificate to obtain unintended database roles when PROXY protocol v2 is used over the Unix domain socket, because certificate-derived roles bypass the configured tlsCATrusts allow-list during MONGODB-X509 authentication. An attacker with local access to the proxy socket can therefore escalate to roles they were never granted, compromising confidentiality and integrity of data. Tracked via MongoDB SERVER-128387 and rated CVSS 4.0 7.2 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.