Skip to content
OpenAdvisories
High WID-SEC-2026-2487 26 CVEs

MongoDB: Mehrere Schwachstellen

Published Jul 22, 2026 · Updated Jul 22, 2026 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Speicherbeschädigungen herbeizuführen oder einen Denial-of-Service-Zustand zu verursachen.

Product

MongoDB ist ein Open-Source-Dokumentendatenbank.

Vulnerabilities 26

  • High 8.1
    CVE-2026-13059

    Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass

    An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, u…

    MongoDB MongoDB Server mongodb Ubuntu
  • High 8.1
    CVE-2026-13072

    MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption

    When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavi…

    MongoDB MongoDB Server mongodb Ubuntu
  • High 7.8
    CVE-2026-14881

    Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

    When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be s…

    MongoDB MongoDB Compass
  • High 7.7
    CVE-2026-13078 Public exploit

    Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

    A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges…

    MongoDB MongoDB Server mongodb Ubuntu
  • High 7.1
    CVE-2026-13058

    Transaction Command Insufficient Input Validation Leading to Process Termination

    An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction …

    MongoDB MongoDB Server mongodb Ubuntu
  • High 7.1
    CVE-2026-13077

    Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data

    A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data …

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-13055

    Server crash via aggregation pipeline expression with compound wildcard index specification

    The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server pr…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-13056

    A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM

    Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-13060

    $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access

    An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affe…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-13062

    MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

    An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a shar…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-13064

    MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service

    Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through s…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-13065

    MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

    A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stem…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-13066

    Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure

    Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure aff…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-13069

    Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion

    An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resour…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-13071

    Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination

    An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-13075

    $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation

    An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-13076

    Aggregation Framework Memory Exhaustion Leading to Process Termination

    An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-9737

    Find command with $meta sort can lead to crash

    During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure.

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.3
    CVE-2026-13067

    tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket

    When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authenticatio…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 5.3
    CVE-2026-13057

    Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META

    An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 5.3
    CVE-2026-13070

    Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination

    A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenar…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 5.3
    CVE-2026-13074

    Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service

    An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that …

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 4.3
    CVE-2026-13061

    Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage

    An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active s…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 4.3
    CVE-2026-13063

    libmongocrypt Improper Input Validation Leading to Process Termination

    An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, w…

    MongoDB MongoDB Server mongodb libmongocrypt Ubuntu
  • Medium 4.3
    CVE-2026-13073

    MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination

    An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an int…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 4.2
    CVE-2026-13068

    MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse

    An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check th…

    MongoDB MongoDB Server mongodb Ubuntu

Revision history

  1. #1

    Initiale Fassung

References