Skip to content
OpenAdvisories
Medium WID-SEC-2026-3924 5 CVEs

MongoDB: Mehrere Schwachstellen

Published Oct 13, 2026 · Updated Oct 13, 2026 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Angriff zu starten.

Product

MongoDB ist ein Open-Source-Dokumentendatenbank.

Vulnerabilities 5

  • Medium 6.5
    CVE-2026-104004

    Collection validators using collation-accepting expressions can crash MongoDB Server on insert

    MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated user…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-104005

    Incorrect authorization in MongoDB Server router for bulk writes to system namespaces

    A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregatio…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-96297

    MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline

    Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 6.5
    CVE-2026-96299

    Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service

    A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregatio…

    MongoDB MongoDB Server mongodb Ubuntu
  • Medium 5.4
    CVE-2026-103965

    Fixed values in MongoDB Server $bucket stage may be misread as field references

    An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output tha…

    MongoDB MongoDB Server mongodb Ubuntu

Revision history

  1. #1

    Initiale Fassung

References