Skip to content
OpenAdvisories
Medium WID-SEC-2026-4561 6 CVEs

MongoDB Treiber (C#, Libmongocrypt, Atlas SQL JDBC, Rust, Node.js): Mehrere Schwachstellen

Published Nov 12, 2026 · Updated Nov 12, 2026 · de

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in verschiedenen MongoDB Treibern (C#, Libmongocrypt, Atlas SQL JDBC, Rust, Node.js) ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Dateien zu manipulieren.

Product

MongoDB ist ein Open-Source-Dokumentendatenbank.

Vulnerabilities 6

  • High 7.7
    CVE-2026-126982

    A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to …

    MongoDB C Driver
  • High 7.0
    CVE-2026-126823

    Atlas SQL JDBC driver loads a native library it did not write: NativeLoader tolerates a pre-existing libmongosqltranslate.so in a shared temp dir

    A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library loading routine will accept and load without verifying its origin. Loading the driver class in a Java application may …

    MongoDB Atlas SQL JDBC Driver
  • Medium 6.5
    CVE-2026-126835

    [Node.js Driver] OIDC ENVIRONMENT confusion bypasses ALLOWED_HOSTS and leaks human-callback bearer tokens

    The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of …

    MongoDB Node.js Driver
  • Medium 5.5
    CVE-2026-126838

    Rust Driver public Client Debug output exposes CSFLE KMS master-key material

    A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may…

    MongoDB Rust Driver
  • Medium 4.7
    CVE-2026-126792

    Heap overflow via oversized RSA signature in GCP KMS signing callback

    A memory-safety flaw in the key-management request-building component of the library can lead to an out-of-bounds write on the heap. A fixed-size output buffer is used under an assumption about cryptographic key size that is never validated, so when the libra…

    MongoDB Libmongocrypt Driver
  • Low 2.3
    CVE-2026-126839

    A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used t…

    MongoDB C Driver

Revision history

  1. #1

    Initiale Fassung

References