Mongodb Inc
Monthly
MongoDB Shell (mongosh) versions prior to 2.14.0 bundle a Node.js runtime whose TLS root store includes recoverable eMudhra intermediate CA certificates, so an unauthenticated on-path attacker who can present a certificate chain under that CA could intercept and alter TLS connections when a victim initiates a mongosh TLS session. The issue is CWE-295 improper certificate validation and is rated CVSS 4.0 7.6 (High); exploitation requires a MITM network position plus victim-initiated interaction, and npm-based installs instead depend on the host Node.js runtime. The vendor fix is mongosh 2.14.0 bundling Node.js 24.22.1 or later, and no public exploit identified at time of analysis.
MongoDB Compass versions prior to 1.53.1 ship an Electron runtime whose bundled TLS root store still contains the compromised, recoverable eMudhra intermediate CA certificates, so a party holding a certificate chained to those intermediates can be treated as trusted by the application. Because the attacker must also occupy a man-in-the-middle position on the network path and induce a user to initiate a Compass connection through it, impact is confidential and integrity-related (VC:H/VI:H) rather than an unauthenticated remote take-over. The vendor resolves the issue in Compass 1.53.1, which bundles Electron 44.9.1; no public exploit code or active exploitation has been reported, and the issue is prioritised as this week rather than an emergency.
Stack exhaustion in the MongoDB PHP driver's BSON decoder allows unauthenticated attackers to terminate PHP processes that process crafted binary documents, causing availability loss. The issue affects driver deployments where application code passes attacker-controlled BSON into the decoder rather than only decoding trusted server responses; no public exploit code has been identified at time of analysis, and the CVSS 4.0 AT:P prerequisite reflects that deployment condition.
Code injection in Mongoid allows unauthenticated attackers who can influence a query argument to execute arbitrary JavaScript in the MongoDB server via a string-typed query criterion, leading to disclosure of stored field values, unintended document selection for writes, and reduced database performance. The vulnerability affects Mongoid versions 8.0.0 through 8.0.12, 8.1.0 through 8.1.12, 9.0.0 through 9.0.11, and 9.1.0, but exploitation requires the application to pass externally influenced string criteria to the query builder and the MongoDB deployment to permit server-side JavaScript evaluation. No public exploit identified at time of analysis.
Unauthenticated, remote query-operator injection in Mongoid - the official MongoDB object-document mapper for Ruby - allows an attacker to shape how MongoDB evaluates a query whenever an application forwards externally supplied filter parameters straight into Mongoid query-building methods without whitelisting allowed operators. Successful abuse can disclose stored field values (for example through $ne, $gt or $regex-style filter logic used for blind extraction) and, because operators such as $regex or $where can force expensive scans, can degrade database performance. The impact is conditional: the vendor's CVSS 4.0 vector carries AT:P (attack requirements present) and our assessment uses AC:H, because exploitation depends entirely on the downstream application's query-construction pattern rather than on a Mongoid setting. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided. CVSS 4.0 base is 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L) and our independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L, i.e. high confidentiality impact with a limited availability effect and no integrity impact.
CPU exhaustion in MongoDB's Mongoid Ruby ODM allows an unauthenticated remote party to render an embedding application unresponsive by supplying crafted text that lands inside a pattern-matching query condition Mongoid evaluates in memory against an embedded association, triggering catastrophic regex backtracking (CWE-1333, ReDoS). The impact is availability-only: the affected Ruby application process burns CPU and stops responding, with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and reachability depends on a specific application coding pattern, which is why the independent assessment applies AC:H and treats deployments that never route untrusted input into regex conditions on embedded documents as out of scope (the CNA's CVSS 4.0 vector rates it 8.7 with AC:L, a more aggressive reading than the assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
Data disclosure and permanent record deletion in Mongoid can be triggered by an unauthenticated remote attacker when an application passes an externally supplied field name to certain in-memory query methods for embedded documents, exploiting an unsafe reflection weakness (CWE-470). The vendor CVSS 4.0 base score of 9.2 reflects the network vector and high impact across confidentiality, integrity, and availability, though the attack requires a developer-dependent data flow (AT:P) where untrusted input reaches a field name parameter. No public exploit code or active exploitation has been identified at time of analysis, and affected/fixed versions remain unconfirmed due to an unbounded CPE (mongoid:*).
Silent, warning-free failure of encryption-configuration generation in the Mongoid object-document mapper causes fields that an application explicitly declared for client-side field-level encryption (CSFLE) to be written to MongoDB as cleartext, allowing any party with ordinary read access to the database - a DBA, a read replica, a backup, or a lower-privilege account with query rights - to read values that were intended to be protected from them. Only applications built on Mongoid that use MongoDB CSFLE and declare fields for encryption are affected; the CVSS vectors (the supplied 4.0 vector with PR:L and the independently assessed 3.1 vector with PR:L) indicate the attacker requires some existing privilege, consistent with the assessed precondition of ordinary database read access rather than an unauthenticated remote path. No public exploit code has been identified at time of analysis, and this is assessed as a genuine but conditional data-protection failure rather than an actively exploited priority.
Mongoid can silently persist values in readable form that applications intended to encrypt, because its client-side field-level encryption (CSFLE) schema generation omits encryption rules for fields declared on embedded models - the MongoDB driver then writes those values unencrypted with no error or warning. The exposure is limited to applications that both enable CSFLE and declare encrypted fields on embedded documents (top-level fields are not implicated), and to parties who already hold read access to the database, a backup, or the underlying on-disk data files; there is no write, integrity, or availability impact and no remote code execution. Data-level risk is real but bounded: no public exploit code identified at time of analysis, no confirmed active exploitation, and the reported CVSS 4.0 base score of 7.1 is consistent with the independent CVSS 3.1 assessment of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Unsafe reflection (CWE-470) in Mongoid's document persistence layer allows a crafted key to be reflected into an internal method invocation instead of the intended array-field update, which can delete stored records and render the embedding application unresponsive. The affected component is Mongoid, MongoDB's Ruby object-document mapper; the CPE record (cpe:2.3:a:mongodb_inc.:mongoid:*:*:*:*:*:*:*) carries no version bounds, so the vendor has not published a bounded version range, and exposure applies to any embedding application that forwards unauthenticated, attacker-controlled keys directly into an array-field update. The CVSS 4.0 vector marks this dependency as AT:P (Attack Requirements: Present), meaning Mongoid is not exploitable in isolation, but where that non-default coding pattern exists there is no authentication or user-interaction barrier (PR:N, UI:N/A:H). Impact is integrity and availability only (VI:H/VA:H, VC:N), and no public exploit code has been identified at time of analysis.
Insecure direct object reference in Mongoid's nested-attributes handling lets an authenticated user with basic application privileges supply another user's record identifier, causing Mongoid to look up that record outside ownership or tenant scoping and then update and link it to the requester's own record-resulting in unintended disclosure and unauthorized modification of data. Exploitation is limited to applications that use accept_nested_attributes_for on ownership- or tenant-scoped associations and rely on Mongoid to enforce scoping; no public exploit identified at time of analysis, and no confirmed affected or fixed versions because the only reference is an unbounded MongoDB Jira advisory with a wildcard CPE.
Heap-based buffer overflow in the TLS transport layer of the MongoDB C Driver on Windows TLS-backend builds allows the endpoint a client connects to - or an attacker able to impersonate, redirect, or man-in-the-middle that connection - to write attacker-supplied data outside the bounds of a heap allocation while the driver processes incoming encrypted traffic, causing memory corruption, disclosure of adjacent heap memory, or termination of the client process. The flaw is reachable before any application-level authentication completes, so no credentials or user interaction are needed (CVSS PR:N/UI:N), and the vendor rates it 9.2 under CVSS 4.0; however, our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the real gating factors - this is a client-side defect that only fires when the driver connects to an attacker-controlled endpoint or when the attacker can intercept or redirect the connection (AC:H, AT:P), and only in builds compiled against the Windows platform TLS backend. All C Driver releases in the affected ranges (1.24.0 through the 2.4.0 series per ENISA EUVD) are in scope, tracked as CDRIVER-6417; no public exploit code was identified at time of analysis.
Denial of service in MongoDB Server 7.0, 8.0, and 8.2 allows authenticated remote attackers to crash the database by inserting documents that trigger updates to a maliciously created '2dsphere_bucket' or 'queryable_encrypted_range' index on a non-timeseries bucket collection. The flaw stems from a reachable assertion (CWE-617) and is reported by MongoDB itself with a vendor patch available; no public exploit identified at time of analysis.
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or mapreduce map functions) with subsequent JavaScript engine invocations ($where, $function, mapreduce reduce stages), triggering a use-after-free condition. Affects MongoDB Server 7.0 (prior to 7.0.34), 8.0 (prior to 8.0.23), 8.2 (prior to 8.2.9), and 8.3 (prior to 8.3.2). Vendor-released patches available for all affected branches. No public exploit identified at time of analysis; EPSS score of 0.05% (16th percentile) suggests low observed exploitation probability despite 7.7 CVSS score. The CWE-416 use-after-free root cause requires precise sequencing of JavaScript operations, limiting exploitability.
Authenticated attackers can exhaust MongoDB Server memory using malicious bitwise match expressions ($bitsAllSet, $bitsAnySet, $bitsAllClear, $bitsAnyClear), leading to out-of-memory denial of service. Affects MongoDB Server 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. Vendor-released patches are available across all affected major versions. EPSS score of 0.04% (12th percentile) indicates low observed exploitation probability in the wild, and no public exploit code has been identified at time of analysis.
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authenticated users with database write privileges. Affects all active release branches (5.0 through 8.3) when exploiting field-name-to-index mapping inconsistencies in the time-series bucket catalog. EPSS score of 0.06% (20th percentile) suggests low widespread exploitation probability despite high CVSS 8.7, but requires authentication and database privileges, limiting attack surface to insider threats or compromised application credentials. No public exploit code or CISA KEV listing identified at time of analysis.
Command injection in MongoDB Ops Manager (all 7.0 versions and 8.0.22 and prior) lets an administrative user with webhook-configuration rights achieve arbitrary command execution by embedding malicious FreeMarker template syntax in a webhook and then triggering it. The flaw is vendor-reported (MongoDB) with a patch in 8.0.23; there is no public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with SSVC's 'exploitation: none' rating despite the total technical impact.
MongoDB Server 8.2 before version 8.2.7 crashes when an authenticated user supplies an empty pipeline to $rankFusion or $scoreFusion aggregation operators on a view. The server fails to validate that the pipeline array is non-empty before accessing its first element during view resolution, resulting in a null pointer dereference that terminates the mongod process. This denial-of-service condition requires database authentication but can be triggered remotely via aggregation queries.
Heap buffer overflow in MongoDB C Driver's Cyrus SASL integration allows local attackers to achieve code execution before authentication by providing a maliciously crafted username in a MongoDB URI with GSSAPI authentication. The vulnerability triggers during username canonicalization via unsafe string copying, requiring no privileges or user interaction. Exploitable against any application using the affected driver that processes untrusted MongoDB connection strings. No active exploitation confirmed (not in CISA KEV). EPSS data not provided. Vendor has acknowledged the issue via JIRA tracking (CDRIVER-6134).
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read permissions execute malicious $lookup or $graphLookup aggregation pipeline operations. An attacker can exploit this vulnerability to achieve high-impact outcomes including information disclosure, data manipulation, and denial of service. No patch is currently available for this vulnerability.
An authenticated user with read-only role can extract limited amounts of uninitialized stack memory through specially crafted issuances of the filemd5 command in MongoDB Server. This information disclosure vulnerability affects MongoDB Server versions 8.2 prior to 8.2.6, 8.0 prior to 8.0.20, and 7.0 prior to 7.0.31. An attacker with valid database read credentials can exploit this to leak sensitive data from process memory without requiring elevated privileges or user interaction.
Request forgery in MongoDB Controllers for Kubernetes allows an authenticated user who can modify an OpsManager custom resource to cause unintended administrative changes in Enterprise Ops Manager when backup reconciliation is enabled. The flaw involves insufficient escaping of Ops Manager backup store identifiers when the controller builds admin API request paths. It is a low-severity issue with no public exploit identified at time of analysis, and the vendor fixed it in MongoDB Controllers for Kubernetes 1.13.0.
Denial of service in applications using the MongoDB C Driver's libbson library can be triggered by crafted BSON input with a zero document-length field, which causes an integer underflow (CWE-191) and a heap out-of-bounds read that crashes the process. The CVSS v4.0 vector indicates remote, unauthenticated exploitation (AV:N/PR:N/UI:N), but the vulnerability only affects code paths that pass untrusted BSON to bson_new_from_buffer(), and impact is limited to a process crash with no data disclosure or code execution. No public exploit code or active exploitation (CISA KEV) was identified in the provided intelligence.
SCRAM authentication in the MongoDB C Driver (libmongoc) fails to abort when a nonce mismatch is detected in the server's first message, so the client continues the handshake and still transmits its client proof. An unauthenticated, on-path attacker who can inject a crafted server-first message containing an attacker-controlled salt and a low iteration count on a plaintext connection can capture that proof and brute-force the password offline. The flaw affects C Driver 2.0.0 through versions before 2.3.2, and the vendor explicitly notes TLS mitigates it, so standard TLS-protected production deployments are not exploitable; no public exploit code was identified at time of analysis. The vendor/ENISA CVSS 4.0 base score is 6.3, while our independent assessment (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) rates real-world risk moderate-to-low because exploitation requires both a man-in-the-middle position and an unencrypted or TLS-stripped MongoDB connection, and the payoff is only a captured proof that must still be cracked.
Field level encryption can be silently disabled in applications built on the MongoDB Entity Framework Core Provider when the connection string places a database name there, causing sensitive fields to be stored or read without the intended protection. This affects only applications that rely on field level encryption to protect sensitive data; deployments not using FLE are unaffected. The attacker must already have read access to the MongoDB datastore, backups, or network traffic to benefit, and no public exploit identified at time of analysis. The CVE feed lists CVSS 6.8, while the independent assessment rates it as a conditional data-protection weakness (CWE-311), not a remote code-execution flaw.
Sensitive credential disclosure in the MongoDB Entity Framework Core Provider occurs when the application runs with DEBUG-level logging enabled or when a malformed MongoDB connection string is supplied, causing the provider to record the connection string - including any embedded passwords and AWS secret access keys, where used - into application logs. Realistic exploitation requires local access plus existing privileges sufficient to read those logs, and it is confined to non-default configurations; deployments that obtain credentials from IAM roles or secret managers rather than inline connection strings are largely unaffected. No public exploit has been identified at time of analysis, and this is a genuine but low-to-moderate priority information-disclosure flaw rather than an urgent one.
MongoDB EF Core silently drops TLS and schema-map (client-side field-level/queryable encryption field map) settings when an application configures encryption both through independent/application-level settings and through the provider's own encryption settings, causing fields that were meant to be encrypted to be persisted in the database as cleartext. Only .NET applications built on the MongoDB Entity Framework Core Provider that combine both encryption configuration paths are affected; deployments using a single path, or not using field encryption at all, are not affected. No public exploit identified at time of analysis - the flaw is a silent misconfiguration with no attacker interaction at write time, and actual disclosure additionally requires a party to gain read access to the underlying MongoDB data, backups, or logs (CWE-311, Missing Encryption of Sensitive Data).
Prototype pollution in MongoDB Compass's CSV import parsing logic creates a '1-click' command execution path across versions 1.36.x through 1.49.5. A crafted CSV file can pollute JavaScript object prototypes during the import workflow, causing untrusted file paths to reach Electron's shell.openExternal() API and be executed by the operating system's default handler. No public exploit code has been identified and this CVE is absent from CISA KEV, but the passive user-interaction requirement - simply importing a CSV as part of routine database work - makes targeted social engineering a credible delivery vector in data-heavy environments.
The legacy GridFS API in the MongoDB C Driver fails to validate file metadata fields retrieved from the database, enabling crafted documents stored in a GridFS collection to trigger either a division-by-zero crash (denial of service) or an out-of-bounds read that exposes process memory contents to the caller. Versions in the 1.x branch before 1.30.8 and 2.x branch before 2.2.4 are affected per EUVD-2026-31132. The CVSS 4.0 score of 6.0 accurately reflects a constrained attack path requiring low-privilege database access and a pre-positioned malicious document (AT:P), with no public exploit identified at time of analysis.
Stack exhaustion in MongoDB PHP driver allows remote denial of service when processing deeply nested BSON documents from untrusted sources. Unauthenticated attackers can crash applications by sending maliciously crafted BSON payloads with excessive nesting levels, affecting all versions of the PHP driver that parse BSON without depth limits. The vulnerability requires high attack complexity but results in complete availability loss.
Denial of service in MongoDB Server v7.0 through v8.3 allows authenticated users with aggregation permissions to exhaust CPU resources via densely populated character masks in $trim, $ltrim, and $rtrim aggregation operators. An attacker can pin CPU utilization at 100% for extended periods by crafting malicious aggregation queries with large input strings and computationally expensive mask patterns. No public exploit code or active exploitation has been reported at time of analysis.
Use-after-free in MongoDB Server's Field-Level Encryption query analysis component allows authenticated remote attackers with control over FLE query structure to cause information disclosure and denial of service. The vulnerability affects mongocryptd and crypt_shared in versions 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. No public exploit code identified at time of analysis.
MongoDB Server fails to fully redact user data in local server log messages when schema validation is enabled and an update or insert operation violates the collection schema, allowing authenticated administrators to access sensitive information through log inspection. This information disclosure affects MongoDB Server 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. The vulnerability requires high-privilege administrative access and has a low CVSS score of 2.7, indicating limited real-world impact despite confirmed patch availability.
MongoDB C Driver bson_validate function returns early on specific inputs and incorrectly reports successful validation, allowing malformed or invalid UTF-8 sequences in BSON data to bypass validation checks. This affects MongoDB C Driver versions prior to 1.30.5, 2.0.0, and 2.0.1, and impacts applications that depend on this validation function to process untrusted BSON data. Authenticated remote attackers can exploit this to inject invalid BSON data, potentially causing integrity issues in downstream processing; EPSS 0.48 indicates this is a moderate-priority issue that warrants patching but is not among the highest-risk vulnerabilities.
Crash-inducing denial-of-service in the MongoDB C Driver (all versions before 2.2.3) allows a network-privileged adversary - either a compromised third-party cloud server the application trusts or a man-in-the-middle attacker on the network path - to crash the consuming application by delivering a malformed HTTP response. The vulnerability carries a CVSS 4.0 score of 2.0 due to high attack complexity, prerequisite network positioning, and impact limited strictly to low availability on the vulnerable system. No public exploit code exists and EPSS probability sits at 0.03% (8th percentile), indicating negligible observed exploitation activity at time of analysis.
Memory corruption in MongoDB Server's slot-based execution engine can be triggered by authenticated users with write privileges through malicious $lookup aggregation queries that cause hash table spillover to disk. Successful exploitation enables denial of service and potential information disclosure, though a patch is not currently available. The attack requires network access and specific query construction, limiting the practical exploit window.
MongoDB Shell (mongosh) versions prior to 2.14.0 bundle a Node.js runtime whose TLS root store includes recoverable eMudhra intermediate CA certificates, so an unauthenticated on-path attacker who can present a certificate chain under that CA could intercept and alter TLS connections when a victim initiates a mongosh TLS session. The issue is CWE-295 improper certificate validation and is rated CVSS 4.0 7.6 (High); exploitation requires a MITM network position plus victim-initiated interaction, and npm-based installs instead depend on the host Node.js runtime. The vendor fix is mongosh 2.14.0 bundling Node.js 24.22.1 or later, and no public exploit identified at time of analysis.
MongoDB Compass versions prior to 1.53.1 ship an Electron runtime whose bundled TLS root store still contains the compromised, recoverable eMudhra intermediate CA certificates, so a party holding a certificate chained to those intermediates can be treated as trusted by the application. Because the attacker must also occupy a man-in-the-middle position on the network path and induce a user to initiate a Compass connection through it, impact is confidential and integrity-related (VC:H/VI:H) rather than an unauthenticated remote take-over. The vendor resolves the issue in Compass 1.53.1, which bundles Electron 44.9.1; no public exploit code or active exploitation has been reported, and the issue is prioritised as this week rather than an emergency.
Stack exhaustion in the MongoDB PHP driver's BSON decoder allows unauthenticated attackers to terminate PHP processes that process crafted binary documents, causing availability loss. The issue affects driver deployments where application code passes attacker-controlled BSON into the decoder rather than only decoding trusted server responses; no public exploit code has been identified at time of analysis, and the CVSS 4.0 AT:P prerequisite reflects that deployment condition.
Code injection in Mongoid allows unauthenticated attackers who can influence a query argument to execute arbitrary JavaScript in the MongoDB server via a string-typed query criterion, leading to disclosure of stored field values, unintended document selection for writes, and reduced database performance. The vulnerability affects Mongoid versions 8.0.0 through 8.0.12, 8.1.0 through 8.1.12, 9.0.0 through 9.0.11, and 9.1.0, but exploitation requires the application to pass externally influenced string criteria to the query builder and the MongoDB deployment to permit server-side JavaScript evaluation. No public exploit identified at time of analysis.
Unauthenticated, remote query-operator injection in Mongoid - the official MongoDB object-document mapper for Ruby - allows an attacker to shape how MongoDB evaluates a query whenever an application forwards externally supplied filter parameters straight into Mongoid query-building methods without whitelisting allowed operators. Successful abuse can disclose stored field values (for example through $ne, $gt or $regex-style filter logic used for blind extraction) and, because operators such as $regex or $where can force expensive scans, can degrade database performance. The impact is conditional: the vendor's CVSS 4.0 vector carries AT:P (attack requirements present) and our assessment uses AC:H, because exploitation depends entirely on the downstream application's query-construction pattern rather than on a Mongoid setting. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided. CVSS 4.0 base is 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L) and our independent CVSS 3.1 assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L, i.e. high confidentiality impact with a limited availability effect and no integrity impact.
CPU exhaustion in MongoDB's Mongoid Ruby ODM allows an unauthenticated remote party to render an embedding application unresponsive by supplying crafted text that lands inside a pattern-matching query condition Mongoid evaluates in memory against an embedded association, triggering catastrophic regex backtracking (CWE-1333, ReDoS). The impact is availability-only: the affected Ruby application process burns CPU and stops responding, with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and reachability depends on a specific application coding pattern, which is why the independent assessment applies AC:H and treats deployments that never route untrusted input into regex conditions on embedded documents as out of scope (the CNA's CVSS 4.0 vector rates it 8.7 with AC:L, a more aggressive reading than the assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
Data disclosure and permanent record deletion in Mongoid can be triggered by an unauthenticated remote attacker when an application passes an externally supplied field name to certain in-memory query methods for embedded documents, exploiting an unsafe reflection weakness (CWE-470). The vendor CVSS 4.0 base score of 9.2 reflects the network vector and high impact across confidentiality, integrity, and availability, though the attack requires a developer-dependent data flow (AT:P) where untrusted input reaches a field name parameter. No public exploit code or active exploitation has been identified at time of analysis, and affected/fixed versions remain unconfirmed due to an unbounded CPE (mongoid:*).
Silent, warning-free failure of encryption-configuration generation in the Mongoid object-document mapper causes fields that an application explicitly declared for client-side field-level encryption (CSFLE) to be written to MongoDB as cleartext, allowing any party with ordinary read access to the database - a DBA, a read replica, a backup, or a lower-privilege account with query rights - to read values that were intended to be protected from them. Only applications built on Mongoid that use MongoDB CSFLE and declare fields for encryption are affected; the CVSS vectors (the supplied 4.0 vector with PR:L and the independently assessed 3.1 vector with PR:L) indicate the attacker requires some existing privilege, consistent with the assessed precondition of ordinary database read access rather than an unauthenticated remote path. No public exploit code has been identified at time of analysis, and this is assessed as a genuine but conditional data-protection failure rather than an actively exploited priority.
Mongoid can silently persist values in readable form that applications intended to encrypt, because its client-side field-level encryption (CSFLE) schema generation omits encryption rules for fields declared on embedded models - the MongoDB driver then writes those values unencrypted with no error or warning. The exposure is limited to applications that both enable CSFLE and declare encrypted fields on embedded documents (top-level fields are not implicated), and to parties who already hold read access to the database, a backup, or the underlying on-disk data files; there is no write, integrity, or availability impact and no remote code execution. Data-level risk is real but bounded: no public exploit code identified at time of analysis, no confirmed active exploitation, and the reported CVSS 4.0 base score of 7.1 is consistent with the independent CVSS 3.1 assessment of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Unsafe reflection (CWE-470) in Mongoid's document persistence layer allows a crafted key to be reflected into an internal method invocation instead of the intended array-field update, which can delete stored records and render the embedding application unresponsive. The affected component is Mongoid, MongoDB's Ruby object-document mapper; the CPE record (cpe:2.3:a:mongodb_inc.:mongoid:*:*:*:*:*:*:*) carries no version bounds, so the vendor has not published a bounded version range, and exposure applies to any embedding application that forwards unauthenticated, attacker-controlled keys directly into an array-field update. The CVSS 4.0 vector marks this dependency as AT:P (Attack Requirements: Present), meaning Mongoid is not exploitable in isolation, but where that non-default coding pattern exists there is no authentication or user-interaction barrier (PR:N, UI:N/A:H). Impact is integrity and availability only (VI:H/VA:H, VC:N), and no public exploit code has been identified at time of analysis.
Insecure direct object reference in Mongoid's nested-attributes handling lets an authenticated user with basic application privileges supply another user's record identifier, causing Mongoid to look up that record outside ownership or tenant scoping and then update and link it to the requester's own record-resulting in unintended disclosure and unauthorized modification of data. Exploitation is limited to applications that use accept_nested_attributes_for on ownership- or tenant-scoped associations and rely on Mongoid to enforce scoping; no public exploit identified at time of analysis, and no confirmed affected or fixed versions because the only reference is an unbounded MongoDB Jira advisory with a wildcard CPE.
Heap-based buffer overflow in the TLS transport layer of the MongoDB C Driver on Windows TLS-backend builds allows the endpoint a client connects to - or an attacker able to impersonate, redirect, or man-in-the-middle that connection - to write attacker-supplied data outside the bounds of a heap allocation while the driver processes incoming encrypted traffic, causing memory corruption, disclosure of adjacent heap memory, or termination of the client process. The flaw is reachable before any application-level authentication completes, so no credentials or user interaction are needed (CVSS PR:N/UI:N), and the vendor rates it 9.2 under CVSS 4.0; however, our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the real gating factors - this is a client-side defect that only fires when the driver connects to an attacker-controlled endpoint or when the attacker can intercept or redirect the connection (AC:H, AT:P), and only in builds compiled against the Windows platform TLS backend. All C Driver releases in the affected ranges (1.24.0 through the 2.4.0 series per ENISA EUVD) are in scope, tracked as CDRIVER-6417; no public exploit code was identified at time of analysis.
Denial of service in MongoDB Server 7.0, 8.0, and 8.2 allows authenticated remote attackers to crash the database by inserting documents that trigger updates to a maliciously created '2dsphere_bucket' or 'queryable_encrypted_range' index on a non-timeseries bucket collection. The flaw stems from a reachable assertion (CWE-617) and is reported by MongoDB itself with a vendor patch available; no public exploit identified at time of analysis.
Authenticated users can crash MongoDB Server by chaining specific server-side JavaScript operations ($_internalJsEmit or mapreduce map functions) with subsequent JavaScript engine invocations ($where, $function, mapreduce reduce stages), triggering a use-after-free condition. Affects MongoDB Server 7.0 (prior to 7.0.34), 8.0 (prior to 8.0.23), 8.2 (prior to 8.2.9), and 8.3 (prior to 8.3.2). Vendor-released patches available for all affected branches. No public exploit identified at time of analysis; EPSS score of 0.05% (16th percentile) suggests low observed exploitation probability despite 7.7 CVSS score. The CWE-416 use-after-free root cause requires precise sequencing of JavaScript operations, limiting exploitability.
Authenticated attackers can exhaust MongoDB Server memory using malicious bitwise match expressions ($bitsAllSet, $bitsAnySet, $bitsAllClear, $bitsAnyClear), leading to out-of-memory denial of service. Affects MongoDB Server 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. Vendor-released patches are available across all affected major versions. EPSS score of 0.04% (12th percentile) indicates low observed exploitation probability in the wild, and no public exploit code has been identified at time of analysis.
Out-of-bounds memory write in MongoDB Server's time-series collection feature enables arbitrary code execution by authenticated users with database write privileges. Affects all active release branches (5.0 through 8.3) when exploiting field-name-to-index mapping inconsistencies in the time-series bucket catalog. EPSS score of 0.06% (20th percentile) suggests low widespread exploitation probability despite high CVSS 8.7, but requires authentication and database privileges, limiting attack surface to insider threats or compromised application credentials. No public exploit code or CISA KEV listing identified at time of analysis.
Command injection in MongoDB Ops Manager (all 7.0 versions and 8.0.22 and prior) lets an administrative user with webhook-configuration rights achieve arbitrary command execution by embedding malicious FreeMarker template syntax in a webhook and then triggering it. The flaw is vendor-reported (MongoDB) with a patch in 8.0.23; there is no public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with SSVC's 'exploitation: none' rating despite the total technical impact.
MongoDB Server 8.2 before version 8.2.7 crashes when an authenticated user supplies an empty pipeline to $rankFusion or $scoreFusion aggregation operators on a view. The server fails to validate that the pipeline array is non-empty before accessing its first element during view resolution, resulting in a null pointer dereference that terminates the mongod process. This denial-of-service condition requires database authentication but can be triggered remotely via aggregation queries.
Heap buffer overflow in MongoDB C Driver's Cyrus SASL integration allows local attackers to achieve code execution before authentication by providing a maliciously crafted username in a MongoDB URI with GSSAPI authentication. The vulnerability triggers during username canonicalization via unsafe string copying, requiring no privileges or user interaction. Exploitable against any application using the affected driver that processes untrusted MongoDB connection strings. No active exploitation confirmed (not in CISA KEV). EPSS data not provided. Vendor has acknowledged the issue via JIRA tracking (CDRIVER-6134).
MongoDB Server sharded clusters are vulnerable to use-after-free memory corruption when authenticated users with read permissions execute malicious $lookup or $graphLookup aggregation pipeline operations. An attacker can exploit this vulnerability to achieve high-impact outcomes including information disclosure, data manipulation, and denial of service. No patch is currently available for this vulnerability.
An authenticated user with read-only role can extract limited amounts of uninitialized stack memory through specially crafted issuances of the filemd5 command in MongoDB Server. This information disclosure vulnerability affects MongoDB Server versions 8.2 prior to 8.2.6, 8.0 prior to 8.0.20, and 7.0 prior to 7.0.31. An attacker with valid database read credentials can exploit this to leak sensitive data from process memory without requiring elevated privileges or user interaction.
Request forgery in MongoDB Controllers for Kubernetes allows an authenticated user who can modify an OpsManager custom resource to cause unintended administrative changes in Enterprise Ops Manager when backup reconciliation is enabled. The flaw involves insufficient escaping of Ops Manager backup store identifiers when the controller builds admin API request paths. It is a low-severity issue with no public exploit identified at time of analysis, and the vendor fixed it in MongoDB Controllers for Kubernetes 1.13.0.
Denial of service in applications using the MongoDB C Driver's libbson library can be triggered by crafted BSON input with a zero document-length field, which causes an integer underflow (CWE-191) and a heap out-of-bounds read that crashes the process. The CVSS v4.0 vector indicates remote, unauthenticated exploitation (AV:N/PR:N/UI:N), but the vulnerability only affects code paths that pass untrusted BSON to bson_new_from_buffer(), and impact is limited to a process crash with no data disclosure or code execution. No public exploit code or active exploitation (CISA KEV) was identified in the provided intelligence.
SCRAM authentication in the MongoDB C Driver (libmongoc) fails to abort when a nonce mismatch is detected in the server's first message, so the client continues the handshake and still transmits its client proof. An unauthenticated, on-path attacker who can inject a crafted server-first message containing an attacker-controlled salt and a low iteration count on a plaintext connection can capture that proof and brute-force the password offline. The flaw affects C Driver 2.0.0 through versions before 2.3.2, and the vendor explicitly notes TLS mitigates it, so standard TLS-protected production deployments are not exploitable; no public exploit code was identified at time of analysis. The vendor/ENISA CVSS 4.0 base score is 6.3, while our independent assessment (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) rates real-world risk moderate-to-low because exploitation requires both a man-in-the-middle position and an unencrypted or TLS-stripped MongoDB connection, and the payoff is only a captured proof that must still be cracked.
Field level encryption can be silently disabled in applications built on the MongoDB Entity Framework Core Provider when the connection string places a database name there, causing sensitive fields to be stored or read without the intended protection. This affects only applications that rely on field level encryption to protect sensitive data; deployments not using FLE are unaffected. The attacker must already have read access to the MongoDB datastore, backups, or network traffic to benefit, and no public exploit identified at time of analysis. The CVE feed lists CVSS 6.8, while the independent assessment rates it as a conditional data-protection weakness (CWE-311), not a remote code-execution flaw.
Sensitive credential disclosure in the MongoDB Entity Framework Core Provider occurs when the application runs with DEBUG-level logging enabled or when a malformed MongoDB connection string is supplied, causing the provider to record the connection string - including any embedded passwords and AWS secret access keys, where used - into application logs. Realistic exploitation requires local access plus existing privileges sufficient to read those logs, and it is confined to non-default configurations; deployments that obtain credentials from IAM roles or secret managers rather than inline connection strings are largely unaffected. No public exploit has been identified at time of analysis, and this is a genuine but low-to-moderate priority information-disclosure flaw rather than an urgent one.
MongoDB EF Core silently drops TLS and schema-map (client-side field-level/queryable encryption field map) settings when an application configures encryption both through independent/application-level settings and through the provider's own encryption settings, causing fields that were meant to be encrypted to be persisted in the database as cleartext. Only .NET applications built on the MongoDB Entity Framework Core Provider that combine both encryption configuration paths are affected; deployments using a single path, or not using field encryption at all, are not affected. No public exploit identified at time of analysis - the flaw is a silent misconfiguration with no attacker interaction at write time, and actual disclosure additionally requires a party to gain read access to the underlying MongoDB data, backups, or logs (CWE-311, Missing Encryption of Sensitive Data).
Prototype pollution in MongoDB Compass's CSV import parsing logic creates a '1-click' command execution path across versions 1.36.x through 1.49.5. A crafted CSV file can pollute JavaScript object prototypes during the import workflow, causing untrusted file paths to reach Electron's shell.openExternal() API and be executed by the operating system's default handler. No public exploit code has been identified and this CVE is absent from CISA KEV, but the passive user-interaction requirement - simply importing a CSV as part of routine database work - makes targeted social engineering a credible delivery vector in data-heavy environments.
The legacy GridFS API in the MongoDB C Driver fails to validate file metadata fields retrieved from the database, enabling crafted documents stored in a GridFS collection to trigger either a division-by-zero crash (denial of service) or an out-of-bounds read that exposes process memory contents to the caller. Versions in the 1.x branch before 1.30.8 and 2.x branch before 2.2.4 are affected per EUVD-2026-31132. The CVSS 4.0 score of 6.0 accurately reflects a constrained attack path requiring low-privilege database access and a pre-positioned malicious document (AT:P), with no public exploit identified at time of analysis.
Stack exhaustion in MongoDB PHP driver allows remote denial of service when processing deeply nested BSON documents from untrusted sources. Unauthenticated attackers can crash applications by sending maliciously crafted BSON payloads with excessive nesting levels, affecting all versions of the PHP driver that parse BSON without depth limits. The vulnerability requires high attack complexity but results in complete availability loss.
Denial of service in MongoDB Server v7.0 through v8.3 allows authenticated users with aggregation permissions to exhaust CPU resources via densely populated character masks in $trim, $ltrim, and $rtrim aggregation operators. An attacker can pin CPU utilization at 100% for extended periods by crafting malicious aggregation queries with large input strings and computationally expensive mask patterns. No public exploit code or active exploitation has been reported at time of analysis.
Use-after-free in MongoDB Server's Field-Level Encryption query analysis component allows authenticated remote attackers with control over FLE query structure to cause information disclosure and denial of service. The vulnerability affects mongocryptd and crypt_shared in versions 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. No public exploit code identified at time of analysis.
MongoDB Server fails to fully redact user data in local server log messages when schema validation is enabled and an update or insert operation violates the collection schema, allowing authenticated administrators to access sensitive information through log inspection. This information disclosure affects MongoDB Server 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. The vulnerability requires high-privilege administrative access and has a low CVSS score of 2.7, indicating limited real-world impact despite confirmed patch availability.
MongoDB C Driver bson_validate function returns early on specific inputs and incorrectly reports successful validation, allowing malformed or invalid UTF-8 sequences in BSON data to bypass validation checks. This affects MongoDB C Driver versions prior to 1.30.5, 2.0.0, and 2.0.1, and impacts applications that depend on this validation function to process untrusted BSON data. Authenticated remote attackers can exploit this to inject invalid BSON data, potentially causing integrity issues in downstream processing; EPSS 0.48 indicates this is a moderate-priority issue that warrants patching but is not among the highest-risk vulnerabilities.
Crash-inducing denial-of-service in the MongoDB C Driver (all versions before 2.2.3) allows a network-privileged adversary - either a compromised third-party cloud server the application trusts or a man-in-the-middle attacker on the network path - to crash the consuming application by delivering a malformed HTTP response. The vulnerability carries a CVSS 4.0 score of 2.0 due to high attack complexity, prerequisite network positioning, and impact limited strictly to low availability on the vulnerable system. No public exploit code exists and EPSS probability sits at 0.03% (8th percentile), indicating negligible observed exploitation activity at time of analysis.
Memory corruption in MongoDB Server's slot-based execution engine can be triggered by authenticated users with write privileges through malicious $lookup aggregation queries that cause hash table spillover to disk. Successful exploitation enables denial of service and potential information disclosure, though a patch is not currently available. The attack requires network access and specific query construction, limiting the practical exploit window.