Skip to content
OpenAdvisories
Medium WID-SEC-2026-4328 15 CVEs

MongoDB (EF Core Provider, Atlas SQL, C Treiber, Rust Treiber, Database Tools und Node.js Treiber): Mehrere Schwachstellen

Published Nov 3, 2026 · Updated Nov 4, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MongoDB (EF Core Provider, Atlas SQL, C Treiber, Rust Treiber, Database Tools und Node.js Treiber) ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.

Product

MongoDB ist ein Open-Source-Dokumentendatenbank.

Vulnerabilities 15

  • High 8.6
    CVE-2026-119675

    mongorestore may bypass collection guards through a system.buckets prefix

    MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a res…

    MongoDB Database Tools mongo-tools Ubuntu
  • High 7.5
    CVE-2026-120678

    MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)

    A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cau…

    MongoDB C Driver mongo-c-driver mongo-c-driver Debian Ubuntu
  • High 7.5
    CVE-2026-120955

    MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata

    The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence fil…

    MongoDB C Driver mongo-c-driver mongo-c-driver Debian Ubuntu
  • High 7.1
    CVE-2026-120952

    MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds write

    An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target th…

    MongoDB Atlas SQL ODBC Driver
  • High 7.1
    CVE-2026-120956

    remote abort and memory disclosure from a malformed cursor.ns

    The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. T…

    MongoDB C Driver mongo-c-driver mongo-c-driver Debian Ubuntu
  • High 7.0
    CVE-2026-119179

    MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data

    A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation …

    MongoDB Node.js Driver
  • Medium 6.5
    CVE-2026-120684

    MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password

    A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area…

    MongoDB C Driver mongo-c-driver mongo-c-driver Debian Ubuntu
  • Medium 5.5
    CVE-2026-120673

    Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

    A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use …

    MongoDB Rust Driver
  • Medium 5.4
    CVE-2026-120567

    EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference

    The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an aggregation pipeline, …

    MongoDB Entity Framework Core Provider
  • Medium 4.8
    CVE-2026-119672

    mongofiles may disclose GridFS content to standard output through a stored filename

    MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to wr…

    MongoDB Database Tools mongo-tools Ubuntu
  • Medium 4.3
    CVE-2026-120953

    Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler

    A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and pass…

    MongoDB Atlas SQL JDBC Driver
  • Low 3.7
    CVE-2026-119674

    mongorestore may restore encoded collection names into an unintended collection

    MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later aut…

    MongoDB Database Tools mongo-tools Ubuntu
  • Low 3.7
    CVE-2026-120954

    Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views

    A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an a…

    MongoDB C Driver mongo-c-driver mongo-c-driver Debian Ubuntu
  • Low 3.7
    CVE-2026-120959

    MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-array stride, causing out-of-bounds writes

    A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buffer provided by the calling application. A party able to influence the values a query returns may cause data to be place…

    MongoDB Atlas SQL
  • Low 2.8
    CVE-2026-119673

    mongofiles may write outside the working directory through a symlink

    MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause…

    MongoDB Database Tools mongo-tools Ubuntu

Revision history

  1. #2

    doppelte Eintragung bereinigt

  2. #1

    Initiale Fassung

References