# MongoDB Server.

Every CVE that names MongoDB Server among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Incorrect authorization in MongoDB Server router for bulk writes to system namespaces](https://agentprime.io/advisories/CVE-2026-104005.md)
  `CVE-2026-104005` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Denial of service
- [Collection validators using collation-accepting expressions can crash MongoDB Server on insert](https://agentprime.io/advisories/CVE-2026-104004.md)
  `CVE-2026-104004` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [Fixed values in MongoDB Server $bucket stage may be misread as field references](https://agentprime.io/advisories/CVE-2026-103965.md)
  `CVE-2026-103965` · CVE record: MongoDB MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Code injection
- [Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-96299.md)
  `CVE-2026-96299` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Denial of service
- [MongoDB Server may disclose process memory via a crafted \`$\_internalApplyOplogUpdate\` aggregation pipeline](https://agentprime.io/advisories/CVE-2026-96297.md)
  `CVE-2026-96297` · CVE record: MongoDB MongoDB Server · CVSS 6.0 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption](https://agentprime.io/advisories/CVE-2026-89099.md)
  `CVE-2026-89099` · CVE record: MongoDB MongoDB Server · CVSS 7.7 High · Not analysed yet · Published 11 Sept 2026 · Tags: Race condition
- [Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server](https://agentprime.io/advisories/CVE-2026-82076.md)
  `CVE-2026-82076` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service](https://agentprime.io/advisories/CVE-2026-82075.md)
  `CVE-2026-82075` · CVE record: MongoDB MongoDB Server · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Denial of service
- [Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data](https://agentprime.io/advisories/CVE-2026-82074.md)
  `CVE-2026-82074` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [Improper Validation in MongoDB Server Aggregation Framework Allows Authorization Bypass and Unauthorized Collection Access with Atlas Search](https://agentprime.io/advisories/CVE-2026-82073.md)
  `CVE-2026-82073` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write](https://agentprime.io/advisories/CVE-2026-82071.md)
  `CVE-2026-82071` · CVE record: MongoDB MongoDB Server · CVSS 7.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface](https://agentprime.io/advisories/CVE-2026-82070.md)
  `CVE-2026-82070` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials
- [Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router](https://agentprime.io/advisories/CVE-2026-82069.md)
  `CVE-2026-82069` · CVE record: MongoDB MongoDB Server · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-212
- [Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-82068.md)
  `CVE-2026-82068` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Denial of service
- [Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup](https://agentprime.io/advisories/CVE-2026-82067.md)
  `CVE-2026-82067` · CVE record: MongoDB MongoDB Server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-178
- [Heap Out-of-Bounds Read in MongoDB Server Query Planning Component](https://agentprime.io/advisories/CVE-2026-82066.md)
  `CVE-2026-82066` · CVE record: MongoDB MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata](https://agentprime.io/advisories/CVE-2026-82065.md)
  `CVE-2026-82065` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Denial of service
- [Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members](https://agentprime.io/advisories/CVE-2026-82064.md)
  `CVE-2026-82064` · CVE record: MongoDB MongoDB Server · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Denial of service
- [Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-82063.md)
  `CVE-2026-82063` · CVE record: MongoDB MongoDB Server · CVSS 6.0 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Improper Authorization in MongoDB Server applyOps Command Allows Writes to Arbitrary Internal Storage Tables via Feature Gate Bypass](https://agentprime.io/advisories/CVE-2026-82062.md)
  `CVE-2026-82062` · CVE record: MongoDB MongoDB Server · CVSS 7.0 High · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-82061.md)
  `CVE-2026-82061` · CVE record: MongoDB MongoDB Server · CVSS 7.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups](https://agentprime.io/advisories/CVE-2026-82060.md)
  `CVE-2026-82060` · CVE record: MongoDB MongoDB Server · CVSS 2.3 Low · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection
- [Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service](https://agentprime.io/advisories/CVE-2026-82059.md)
  `CVE-2026-82059` · CVE record: MongoDB MongoDB Server · CVSS 6.0 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Denial of service
- [Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-82058.md)
  `CVE-2026-82058` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-248
- [Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of Service](https://agentprime.io/advisories/CVE-2026-82057.md)
  `CVE-2026-82057` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service](https://agentprime.io/advisories/CVE-2026-82056.md)
  `CVE-2026-82056` · CVE record: MongoDB MongoDB Server · CVSS 6.0 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-82055.md)
  `CVE-2026-82055` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-82054.md)
  `CVE-2026-82054` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Denial of service
- [Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment](https://agentprime.io/advisories/CVE-2026-82053.md)
  `CVE-2026-82053` · CVE record: MongoDB MongoDB Server · CVSS 7.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [$regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars](https://agentprime.io/advisories/CVE-2026-82052.md)
  `CVE-2026-82052` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Denial of service
- [Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections](https://agentprime.io/advisories/CVE-2026-18712.md)
  `CVE-2026-18712` · CVE record: MongoDB MongoDB Server · CVSS 7.2 High · Not analysed yet · Published 11 Aug 2026 · Tags: Broken access control
- [Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure](https://agentprime.io/advisories/CVE-2026-18711.md)
  `CVE-2026-18711` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption
- [Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency](https://agentprime.io/advisories/CVE-2026-18709.md)
  `CVE-2026-18709` · CVE record: MongoDB MongoDB Server · CVSS 5.9 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Broken access control
- [Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command](https://agentprime.io/advisories/CVE-2026-18698.md)
  `CVE-2026-18698` · CVE record: MongoDB MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Broken access control
- [Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections](https://agentprime.io/advisories/CVE-2026-18690.md)
  `CVE-2026-18690` · CVE record: MongoDB MongoDB Server · CVSS 7.2 High · Not analysed yet · Published 11 Aug 2026 · Tags: Broken access control
- [Improper Input Validation in MongoDB Query Planner Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-18699.md)
  `CVE-2026-18699` · CVE record: MongoDB MongoDB Server · CVSS 6.0 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption
- [Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure](https://agentprime.io/advisories/CVE-2026-18691.md)
  `CVE-2026-18691` · CVE record: MongoDB MongoDB Server · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-757
- [Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings](https://agentprime.io/advisories/CVE-2026-18702.md)
  `CVE-2026-18702` · CVE record: MongoDB MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Privilege escalation
- [Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure](https://agentprime.io/advisories/CVE-2026-18694.md)
  `CVE-2026-18694` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption
- [Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes](https://agentprime.io/advisories/CVE-2026-18708.md)
  `CVE-2026-18708` · CVE record: MongoDB MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Code injection
- [Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections](https://agentprime.io/advisories/CVE-2026-18696.md)
  `CVE-2026-18696` · CVE record: MongoDB MongoDB Server · CVSS 7.0 High · Not analysed yet · Published 11 Aug 2026 · Tags: Broken access control
- [Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-18700.md)
  `CVE-2026-18700` · CVE record: MongoDB MongoDB Server · CVSS 6.0 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption
- [Type Confusion in MongoDB Query Subsystem Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-18701.md)
  `CVE-2026-18701` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption
- [Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos](https://agentprime.io/advisories/CVE-2026-18697.md)
  `CVE-2026-18697` · CVE record: MongoDB MongoDB Server · CVSS 8.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: Denial of service
- [Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure](https://agentprime.io/advisories/CVE-2026-18693.md)
  `CVE-2026-18693` · CVE record: MongoDB MongoDB Server · CVSS 7.2 High · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption
- [Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data](https://agentprime.io/advisories/CVE-2026-18705.md)
  `CVE-2026-18705` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-807
- [Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations](https://agentprime.io/advisories/CVE-2026-18704.md)
  `CVE-2026-18704` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Broken access control
- [Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution](https://agentprime.io/advisories/CVE-2026-18692.md)
  `CVE-2026-18692` · CVE record: MongoDB MongoDB Server · CVSS 7.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption
- [Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure](https://agentprime.io/advisories/CVE-2026-18688.md)
  `CVE-2026-18688` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption
- [Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-18695.md)
  `CVE-2026-18695` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Denial of service
- [Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption](https://agentprime.io/advisories/CVE-2026-18687.md)
  `CVE-2026-18687` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption
- [Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution](https://agentprime.io/advisories/CVE-2026-18706.md)
  `CVE-2026-18706` · CVE record: MongoDB MongoDB Server · CVSS 7.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Memory corruption
- [Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-18707.md)
  `CVE-2026-18707` · CVE record: MongoDB MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Denial of service
- [Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method](https://agentprime.io/advisories/CVE-2026-18703.md)
  `CVE-2026-18703` · CVE record: MongoDB MongoDB Server · CVSS 2.3 Low · Not analysed yet · Published 11 Aug 2026 · Tags: Broken access control
- [Server crash via aggregation pipeline expression with compound wildcard index specification](https://agentprime.io/advisories/CVE-2026-13055.md)
  `CVE-2026-13055` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM](https://agentprime.io/advisories/CVE-2026-13056.md)
  `CVE-2026-13056` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-1325
- [Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META](https://agentprime.io/advisories/CVE-2026-13057.md)
  `CVE-2026-13057` · CVE record: MongoDB MongoDB Server · CVSS 6.0 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-20
- [Transaction Command Insufficient Input Validation Leading to Process Termination](https://agentprime.io/advisories/CVE-2026-13058.md)
  `CVE-2026-13058` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service
- [Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass](https://agentprime.io/advisories/CVE-2026-13059.md)
  `CVE-2026-13059` · CVE record: MongoDB MongoDB Server · CVSS 8.6 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-807
- [Find command with $meta sort can lead to crash](https://agentprime.io/advisories/CVE-2026-9737.md)
  `CVE-2026-9737` · CVE record: MongoDB MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Denial of service

Older: <https://agentprime.io/advisories/technology/mongodb-server.md?cursor=WyIyMDI2LTA3LTIyVDE5OjIwOjQwLjUyOTAwMFoiLCJDVkUtMjAyNi05NzM3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mongodb-server>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mongodb-server/>. Everything for agents: <https://agentprime.io/llms.txt>.