Companies/MongoDB Atlas/CVEs

MongoDB Atlas CVEs

277 vulnerabilities mapped to MongoDB Atlas’s software or packages, 2 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-10-24

  CVE-2026-115929 MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs

  CVSS 6.8 mediumEPSS 0.19%

• 2026-10-22

  CVE-2026-114655 KMS request injection via unsanitized key vault and provider values in libmongocrypt

  CVSS 5.9 mediumEPSS 0.27%

• 2026-10-22

  CVE-2026-114654 BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards

  CVSS 6.5 mediumEPSS 0.35%

• 2026-10-22

  CVE-2026-114653 Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder

  CVSS 6.5 mediumEPSS 0.21%

• 2026-10-22

  CVE-2026-114652 Update operator injection via single-element list rewriting in the update builder

  CVSS 6.5 mediumEPSS 0.30%

• 2026-10-22

  CVE-2026-114651 Cross-document data leak via malformed BSON array parsing in reused thread buffer

  CVSS 4.0 mediumEPSS 0.39%

• 2026-10-22

  CVE-2026-114650 Plaintext exposure of encrypted fields via ANSI code-page corruption of database name

  CVSS 5.9 mediumEPSS 0.11%

• 2026-10-22

  CVE-2026-114649 Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache

  CVSS 6.8 mediumEPSS 0.20%

• 2026-10-22

  CVE-2026-114648 NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys

  CVSS 7.6 highEPSS 0.32%

• 2026-10-22

  CVE-2026-114647 NoSQL operator injection via unvalidated replacement document in findOneAndReplace

  CVSS 4.3 mediumEPSS 0.26%

• 2026-10-22

  CVE-2026-114646 NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire

  CVSS 6.5 mediumEPSS 0.26%

• 2026-10-22

  CVE-2026-114645 Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping

  CVSS 5.2 mediumEPSS 0.17%

• 2026-10-22

  CVE-2026-114644 Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization

  CVSS 5.9 mediumEPSS 0.48%

• 2026-10-22

  CVE-2026-114643 Duplicate geometry fields via unvalidated GeoJSON extra members

  CVSS 5.4 mediumEPSS 0.37%

• 2026-10-21

  CVE-2026-113870 Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing

  CVSS 8.8 highEPSS 0.24%

• 2026-10-19

  CVE-2026-112368 Unbounded Recursion in phongo_bson_visit_document/visit_array:

  CVSS 7.5 highEPSS 0.26%

• 2026-10-13

  CVE-2026-104005 Incorrect authorization in MongoDB Server router for bulk writes to system namespaces

  CVSS 6.5 mediumEPSS 0.23%

• 2026-10-13

  CVE-2026-104004 Collection validators using collation-accepting expressions can crash MongoDB Server on insert

  CVSS 6.5 mediumEPSS 0.23%

• 2026-10-13

  CVE-2026-103965 Fixed values in MongoDB Server $bucket stage may be misread as field references

  CVSS 5.4 mediumEPSS 0.15%

• 2026-10-13

  CVE-2026-96299 Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service

  CVSS 6.5 mediumEPSS 0.23%

• 2026-10-13

  CVE-2026-96297 MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline

  CVSS 6.5 mediumEPSS 0.24%

• 2026-10-09

  CVE-2026-87109 Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings

  CVSS 5.3 mediumEPSS 0.23%

• 2026-10-09

  CVE-2026-87108 Ops Manager Improper Authorization in Daily Host Monitoring Retrieval

  CVSS 3.1 lowEPSS 0.14%

• 2026-10-09

  CVE-2026-87110 Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints

  CVSS 5.3 mediumEPSS 0.25%

• 2026-10-08

  CVE-2026-106435 Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

  CVSS 5.1 mediumEPSS 0.09%

• 2026-10-08

  CVE-2026-106436 Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver

  CVSS 4.8 mediumEPSS 0.26%

• 2026-10-08

  CVE-2026-106432 Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver

  CVSS 3.6 lowEPSS 0.17%

• 2026-10-08

  CVE-2026-107325 Application denial of service via missing BSON array length validation in MongoDB Go Driver

  CVSS 5.9 mediumEPSS 0.24%

• 2026-10-08

  CVE-2026-107324 Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver

  CVSS 5.9 mediumEPSS 0.23%

• 2026-10-08

  CVE-2026-106434 Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt

  CVSS 4.3 mediumEPSS 0.11%

• 2026-10-08

  CVE-2026-106433 Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt

  CVSS 8.8 highEPSS 0.27%

• 2026-10-08

  CVE-2026-106429 Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt

  CVSS 6.5 mediumEPSS 0.29%

• 2026-10-08

  CVE-2026-106430 Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver

  CVSS 5.9 mediumEPSS 0.18%

• 2026-10-08

  CVE-2026-106438 Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver

  CVSS 4.0 mediumEPSS 0.11%

• 2026-10-08

  CVE-2026-106437 Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver

  CVSS 6.2 mediumEPSS 0.10%

• 2026-10-08

  CVE-2026-106431 One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver

  CVSS 5.7 mediumEPSS 0.10%

• 2026-10-08

  CVE-2026-106428 Out-of-bounds read in SCRAM response parsing in MongoDB C Driver

  CVSS 3.7 lowEPSS 0.24%

• 2026-10-05

  CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

  CVSS 4.3 mediumEPSS 0.15%

• 2026-09-24

  CVE-2026-96749 Heap out-of-bounds write via signed size overflow in BSON document encoding

  CVSS 8.4 highEPSS 0.19%

• 2026-09-24

  CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts

  CVSS 6.5 mediumEPSS 0.36%

• 2026-09-24

  CVE-2026-96747 Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption

  CVSS 5.0 mediumEPSS 0.19%

• 2026-09-24

  CVE-2026-96745 PHP object injection via unsuppressible __pclass class inference in command monitoring events

  CVSS 5.6 mediumEPSS 0.33%

• 2026-09-24

  CVE-2026-96746 Heap buffer overflow via mid-scan command list growth in client topology monitoring

  CVSS 6.5 mediumEPSS 0.40%

• 2026-09-24

  CVE-2026-96750 Shell script injection via server-supplied database name in Open MongoDB shell

  CVSS 7.1 highEPSS 0.23%

• 2026-09-24

  CVE-2026-96744 Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel

  CVSS 7.1 highEPSS 0.32%

• 2026-09-18

  CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

  CVSS 8.6 highEPSS 0.43%

• 2026-09-18

  CVE-2026-93760 NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard

  CVSS 8.2 highEPSS 0.53%

• 2026-09-18

  CVE-2026-93761 Denial of service via unbounded regex matching in Mongoid's in-memory query matcher

  CVSS 7.5 highEPSS 0.46%

• 2026-09-18

  CVE-2026-93762 Data deletion and attribute disclosure via field-name method injection in in-memory queries

  CVSS 9.8 criticalEPSS 0.57%

• 2026-09-18

  CVE-2026-93763 Silent plaintext persistence via unresolved callable database name in encryption schema map

  CVSS 6.5 mediumEPSS 0.15%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)