Skip to content
OpenAdvisories
High WID-SEC-2026-3320 17 CVEs

MongoDB: Mehrere Schwachstellen

Published Sep 10, 2026 · Updated Nov 12, 2026 · Revision 15 · de

Vendor: Fedora Vendor: Oracle Vendor: Red Hat Vendor: RESF Product: Enterprise Linux Product: Linux Product: Linux Product: Rocky Linux Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um Abfrage- und Zugriffsbeschränkungen zu umgehen, nicht vorgesehene Datensätze oder Dateien auszulesen, zu verändern oder zu löschen sowie unter bestimmten Voraussetzungen MongoDB-Server oder Anwendungen zum Absturz zu bringen und dadurch einen Denial-of-Service zu verursachen.

Product

MongoDB ist ein Open-Source-Dokumentendatenbank.

Vulnerabilities 17

  • High 8.3
    CVE-2026-88023

    GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authentica…

    MongoDB MongoDB PHP Library mongodb/mongodb Packagist
  • High 8.3
    CVE-2026-88024

    GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authentica…

    MongoDB Rust Driver
  • High 8.3
    CVE-2026-88025

    GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticate…

    MongoDB C Driver
  • High 8.3
    CVE-2026-88029

    GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenti…

    MongoDB Python Driver datadog-agent-7.79-core-integrations datadog-agent-7.80-core-integrations Debian Ubuntu Wolfi PyPI
  • High 8.3
    CVE-2026-88030

    GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authentica…

    MongoDB Ruby Driver ruby-mongo ruby-mongo Debian Ubuntu
  • High 8.3
    CVE-2026-88033

    GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authentica…

    MongoDB Java Driver mongo-java-driver mongo-java-driver Debian Ubuntu
  • High 8.3
    CVE-2026-88034

    GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticat…

    MongoDB C Driver mongo-cxx-driver mongo-cxx-driver Debian Ubuntu
  • High 8.3
    CVE-2026-88036

    GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated…

    MongoDB C Driver mongo-c-driver mongo-c-driver Debian Ubuntu Alpine
  • High 8.1
    CVE-2026-88031

    GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticate…

    MongoDB GO Driver golang-mongodb-mongo-driver golang-mongodb-mongo-driver Debian Ubuntu
  • High 7.7
    CVE-2026-88022

    Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel

    Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-arg…

    MongoDB Laravel MongoDB (PHP)
  • High 7.1
    CVE-2026-87803

    An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the…

    Countly countly-server
  • High 7.1
    CVE-2026-88027

    Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel

    Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a li…

    MongoDB Laravel MongoDB (PHP)
  • Medium 6.5
    CVE-2026-82052

    $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars

    The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the  regex match can start in the middle of a multi-code-unit character, triggering…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-88026

    Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver

    Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authe…

    MongoDB C Driver
  • Medium 6.5
    CVE-2026-88028

    Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel

    Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identif…

    MongoDB Laravel MongoDB (PHP)
  • Medium 5.9
    CVE-2026-88032

    Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver

    A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operat…

    MongoDB Java Driver org.mongodb:mongodb-crypt Maven package org.mongodb:mongodb-driver-reactivestreams Maven package Debian Ubuntu
  • Medium 4.7
    CVE-2026-88035

    Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver

    A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the applic…

    MongoDB C Driver mongodb mongo-c-driver Debian Ubuntu Alpine

Revision history

  1. #15

    Neue Updates von Red Hat aufgenommen

  2. #14

    Neue Updates von Red Hat aufgenommen

  3. #13

    Neue Updates von Red Hat aufgenommen

  4. #12

    Neue Updates von Red Hat aufgenommen

  5. #11

    Neue Updates von Red Hat aufgenommen

  6. #10

    Neue Updates von Red Hat aufgenommen

  7. #9

    Neue Updates von Red Hat aufgenommen

  8. #8

    Neue Updates von Red Hat aufgenommen

  9. #7

    Neue Updates von Red Hat aufgenommen

  10. #6

    Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen

  11. #5

    Neue Updates von Oracle Linux aufgenommen

  12. #4

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  13. #3

    Neue Updates von Fedora aufgenommen

  14. #2

    Neue Updates von Fedora aufgenommen

  15. #1

    Initiale Fassung

References