Skip to content
OpenAdvisories
High WID-SEC-2026-2818 7 CVEs

MongoDB: Mehrere Schwachstellen

Published Aug 12, 2026 · Updated Aug 12, 2026 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

MongoDB ist ein Open-Source-Dokumentendatenbank.

Vulnerabilities 7

  • Critical 9.8
    CVE-2026-19001

    MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names

    The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling a…

    MongoDB BI Connector ODBC Driver
  • High 8.1
    CVE-2026-19002

    Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver

    A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects …

    MongoDB BI Connector ODBC Driver
  • High 8.1
    CVE-2026-19004

    MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters

    An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns cr…

    MongoDB BI Connector ODBC Driver
  • High 7.8
    CVE-2026-19003

    MongoDB BI Connector ODBC driver may write outside an allocated buffer when the setup dialog opens a data source with oversized path settings

    A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's …

    MongoDB BI Connector ODBC Driver
  • Medium 6.5
    CVE-2026-18888

    MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character data

    The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond …

    MongoDB BI Connector ODBC Driver mongodb Ubuntu
  • Medium 5.5
    CVE-2026-19502

    Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI

    MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could…

    MongoDB Schema Builder CLI mongodb Ubuntu
  • Medium 4.8
    CVE-2026-19503

    Insufficient OIDC endpoint validation could invoke unintended local protocol handlers

    MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC au…

    MongoDB Atlas SQL ODBC Driver Schema Builder CLI mongodb Ubuntu

Revision history

  1. #1

    Initiale Fassung

References