CompaniesMongoDB AtlasMonthly reportsOctober 2026
MongoDB Atlas in October 2026: incidents, uptime and changes
5incidents posted
2labelled major or critical
99.05%free of major/critical
96.69%free of any incident
0price changes
1notable page changes
Vendor-reported outage time 7 h 1 min, incident time 24 h 37 min. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
By vendor label: Major 2 · Minor 2 · No impact listed 1
Major and critical incidents 2
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Trigger processing may be delayed globally | Major | 5.2 h | resolved | 10-01 | |
| Issue impacting Atlas Search availability on certain clusters | Major | 1.8 h | resolved | 10-09 |
Other incidents 3
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| MongoDB Charts: Infinite login loop when creating new Charts projects | Minor | 5.0 h | resolved | 10-02 | |
| Admin Admin API: Intermittent Increase in 5xx errors | No impact listed | 2.6 h | resolved | 10-09 | |
| GCP Availability Zone europe-west2-b connectivity issues | Minor | 13 h | resolved | 10-20 |
Pricing, legal and trust page changes
- Trust page changed Trust / securityTrust page
CVEs published
- CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator (CVSS 4.3)
- CVE-2026-106428 Out-of-bounds read in SCRAM response parsing in MongoDB C Driver (CVSS 3.7)
- CVE-2026-106431 One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver (CVSS 5.7)
- CVE-2026-106437 Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver (CVSS 6.2)
- CVE-2026-106438 Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver (CVSS 4.0)
- CVE-2026-106430 Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver (CVSS 5.9)
- CVE-2026-106429 Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt (CVSS 6.5)
- CVE-2026-106433 Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt (CVSS 8.8)
- CVE-2026-106434 Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt (CVSS 4.3)
- CVE-2026-107324 Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver (CVSS 5.9)
- CVE-2026-107325 Application denial of service via missing BSON array length validation in MongoDB Go Driver (CVSS 5.9)
- CVE-2026-106432 Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver (CVSS 3.6)
- CVE-2026-106436 Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver (CVSS 4.8)
- CVE-2026-106435 Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver (CVSS 5.1)
- CVE-2026-87110 Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints (CVSS 5.3)
- CVE-2026-87108 Ops Manager Improper Authorization in Daily Host Monitoring Retrieval (CVSS 3.1)
- CVE-2026-87109 Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings (CVSS 5.3)
- CVE-2026-96297 MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline (CVSS 6.5)
- CVE-2026-96299 Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service (CVSS 6.5)
- CVE-2026-103965 Fixed values in MongoDB Server $bucket stage may be misread as field references (CVSS 5.4)
- CVE-2026-104004 Collection validators using collation-accepting expressions can crash MongoDB Server on insert (CVSS 6.5)
- CVE-2026-104005 Incorrect authorization in MongoDB Server router for bulk writes to system namespaces (CVSS 6.5)
- CVE-2026-112368 Unbounded Recursion in phongo_bson_visit_document/visit_array: (CVSS 7.5)
- CVE-2026-113870 Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing (CVSS 8.8)
- CVE-2026-114643 Duplicate geometry fields via unvalidated GeoJSON extra members (CVSS 5.4)
- CVE-2026-114644 Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization (CVSS 5.9)
- CVE-2026-114645 Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping (CVSS 5.2)
- CVE-2026-114646 NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire (CVSS 6.5)
- CVE-2026-114647 NoSQL operator injection via unvalidated replacement document in findOneAndReplace (CVSS 4.3)
- CVE-2026-114648 NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys (CVSS 7.6)
- CVE-2026-114649 Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache (CVSS 6.8)
- CVE-2026-114650 Plaintext exposure of encrypted fields via ANSI code-page corruption of database name (CVSS 5.9)
- CVE-2026-114651 Cross-document data leak via malformed BSON array parsing in reused thread buffer (CVSS 4.0)
- CVE-2026-114652 Update operator injection via single-element list rewriting in the update builder (CVSS 6.5)
- CVE-2026-114653 Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder (CVSS 6.5)
- CVE-2026-114654 BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards (CVSS 6.5)
- CVE-2026-114655 KMS request injection via unsanitized key vault and provider values in libmongocrypt (CVSS 5.9)
- CVE-2026-115929 MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs (CVSS 6.8)
- CVE-2026-115930 MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs (CVSS 6.8)
- CVE-2026-118510 Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs (CVSS 8.8)
- CVE-2026-118581 NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol (CVSS 6.5)
- CVE-2026-116641 The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs (CVSS 6.8)
Cite this
MongoDB Atlas posted 5 status incidents in October 2026 (2 major or critical); 0 price changes and 1 notable page change observed.
- Title
- MongoDB Atlas in October 2026
- Vendor
- MongoDB Atlas
- Date
- URL
- https://rewindex.com/company/mongodb-atlas/2026/10