Skip to content
OpenAdvisories
High WID-SEC-2026-4468 26 CVEs

MongoDB: Mehrere Schwachstellen

Published Nov 10, 2026 · Updated Nov 10, 2026 · de

Platform: Android Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen, beliebigen Code auszuführen, seine Privilegien zu erhöhen, Informationen zu erlangen oder Dateien zu manipulieren.

Product

MongoDB ist ein Open-Source-Dokumentendatenbank.

Vulnerabilities 26

  • Critical 9.0
    CVE-2026-118383 Public exploit

    Pre-authentication use-after-free in MongoDB Server replica set primary catch-up

    A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpec…

    MongoDB MongoDB Server
  • High 8.8
    CVE-2026-120824

    Post-authentication use-after-free in MongoDB Server time-series bucket validation

    A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to write bucket documents directl…

    MongoDB MongoDB Server
  • High 8.4
    CVE-2026-120815

    Incorrect Authorization Check in MongoDB Server Localhost Exception Leads to Unauthorized Administrative Access

    An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended acc…

    MongoDB MongoDB Server
  • High 7.5
    CVE-2026-120804

    Credential-handle retention via missing flag set in Windows Kerberos auth handler

    A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain authentication requests, the server fails to properly release an underlying system resource due to an internal tracking erro…

    MongoDB MongoDB Server
  • High 7.5
    CVE-2026-120828

    Memory exhaustion via abandoned far-future read-concern waiters in disaggregated storage

    A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that names a point in time the node will never reach. A party with network access and no credentials can cause these record…

    MongoDB MongoDB Server
  • High 7.4
    CVE-2026-120808

    Certificate Validation Bypass via IPv6 trust-result skip in macOS TLS client

    An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connections to IPv6-addressed peers. When a MongoDB process using the Apple SecureTransport TLS backend connects to an IPv6 targe…

    MongoDB MongoDB Server
  • High 7.2
    CVE-2026-120814

    MultiUpdateCoordinator state replay lets a shard administrator create a persistent cluster root user

    An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrative privileges to cause persisted internal coordination state to be reprocessed with elevated internal authority. Becaus…

    MongoDB MongoDB Server
  • High 7.1
    CVE-2026-120803

    MongoDB SBE $locf Window Accumulator Use-After-Free Enables Heap OOB Read and Server Crash

    A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator used by certain $setWindowFields aggregation pipelines. Under specific conditions, the accumulator can retain a dangling pointer to memory th…

    MongoDB MongoDB Server
  • High 7.1
    CVE-2026-120818

    Use-After-Free in MongoDB Server JavaScript Support for Aggregation Leads to Information Disclosure

    A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed process memory to be read and returned. An authenticated user with minimal or no assigned roles can trigger this condi…

    MongoDB MongoDB Server
  • Medium 6.8
    CVE-2026-120809

    Heap use-after-free read via yield-time state save in time-series block unpacking

    A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on time-series collections. An internal error in state-preservation logic can cause a value still referenced by downstream sta…

    MongoDB MongoDB Server
  • Medium 6.7
    CVE-2026-120822

    Missing Authorization Check in MongoDB Server Replication-Related Administrative Command Leads to Unauthorized Data Access

    MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges m…

    MongoDB MongoDB Server
  • Medium 6.6
    CVE-2026-120807

    Privilege escalation via fail-open user lookup in X.509 cluster-membership guard

    A flaw in MongoDB’s X.509 cluster-membership authentication guard could allow a holder of a cluster-member certificate to gain elevated internal privileges when a specific deployment configuration is in use. An internal check, which prevents a certificate rec…

    MongoDB MongoDB Server
  • Medium 6.5
    CVE-2026-120810

    Uncontrolled Resource Consumption in MongoDB Server Aggregation Framework via Internal Expression Leads to Denial of Service

    An issue in MongoDB server’s aggregation framework allows an authenticated user with read privileges to cause a denial of service by sending specially crafted aggregate commands using an internal expression. Despite its internal naming, this expression is reg…

    MongoDB MongoDB Server
  • Medium 6.5
    CVE-2026-120812

    Full server crash via unbounded per-operand recursion in time-series query vectorization

    An issue in MongoDB Server's query processing component allows an authenticated user with read privileges to cause a denial of service. Uncontrolled recursion in an internal query compilation component can lead to stack exhaustion and server process terminati…

    MongoDB MongoDB Server
  • Medium 6.5
    CVE-2026-120817

    Post-authentication race condition in MongoDB Server geospatial schema validation

    A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection validator that uses geospatial query operators. The condition can be caused by an authenticated user with write privileges,…

    MongoDB MongoDB Server
  • Medium 6.5
    CVE-2026-120821

    Post-authentication use-after-free in MongoDB Server aggregation sub-pipelines

    A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipeline. The condition can be caused by an authenticated user with read privileges, and may result in the server terminatin…

    MongoDB MongoDB Server
  • Medium 6.5
    CVE-2026-120825

    Improper Authorization in MongoDB Server Aggregation Framework View Definition Validation Leads to Unauthorized Collection Access

    An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege e…

    MongoDB MongoDB Server
  • Medium 6.5
    CVE-2026-120826

    Improper Authorization in MongoDB Server Sharded View Definition Handling Leads to Cross-Database Unauthorized Access

    An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checki…

    MongoDB MongoDB Server
  • Medium 5.9
    CVE-2026-120811

    Use-After-Free in MongoDB Server Classic Query Engine Plan Cache Leads to Information Disclosure and Denial of Service

    A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference to data from an earlier command can be retained in cached plan statistics. After the originating memory is freed, a sub…

    MongoDB MongoDB Server
  • Medium 5.9
    CVE-2026-120813

    Plaintext storage of encrypted fields via duplicate keys in client-side encryption schema parsing

    An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be silently dropped during schema parsing under certain conditions. A party who can deliver a specially crafted schema to a user'…

    MongoDB MongoDB Server
  • Medium 5.5
    CVE-2026-120806

    Authorization role-graph corruption via no-op cleanup filters in dropAllRolesFromDatabase

    A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a database. Due to incorrect internal query predicates, the drop operation removes role definitions but fails to remove s…

    MongoDB MongoDB Server
  • Medium 4.3
    CVE-2026-120805

    Authorization bypass via redirected FLE2 state-collection writes in encrypted CRUD path

    In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-related parameters to redirect internal Queryable Encryption metadata writes to metadata belonging to other encrypted c…

    MongoDB MongoDB Server
  • Medium 4.3
    CVE-2026-120816

    System collection contents readable through a database change stream with showSystemEvents

    A user with basic read-tier database privileges can use an option on a server-side data-change notification feature to receive the contents of certain restricted internal collections that the same user is refused on a direct read. The privilege check for the …

    MongoDB MongoDB Server
  • Medium 4.3
    CVE-2026-120819

    Use-after-free in Wasm JS-BSON bridge lets read-only users read 24 KiB via $accumulator

    A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted da…

    MongoDB MongoDB Server
  • Medium 4.3
    CVE-2026-120820

    Uncontrolled Resource Consumption in MongoDB Server Per-Namespace Encrypted-Field Statistics Table Leads to Denial of Service

    MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are created for any namespace supplied in a request, with no limit on the number of entries and no way to remove entries tha…

    MongoDB MongoDB Server
  • Medium 4.3
    CVE-2026-120823

    Missing Authorization Check in MongoDB Server Aggregation Framework Leads to Unauthorized Access to Deployment-Wide Configuration Data

    A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluste…

    MongoDB MongoDB Server

Revision history

  1. #1

    Initiale Fassung

References