Companies/MongoDB Atlas/CVEs

MongoDB Atlas CVEs

277 vulnerabilities mapped to MongoDB Atlas’s software or packages, 2 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-09-03

  CVE-2026-84967 Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal

  CVSS 4.3 mediumEPSS 0.27%

• 2026-09-03

  CVE-2026-84962 Authenticated KMS request forgery via CRLF injection in GCP key identifier strings

  CVSS 4.2 mediumEPSS 0.19%

• 2026-09-03

  CVE-2026-84963 Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser

  CVSS 5.3 mediumEPSS 0.31%

• 2026-09-03

  CVE-2026-84964 Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client

  CVSS 5.9 mediumEPSS 0.26%

• 2026-09-03

  CVE-2026-84965 Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds

  CVSS 5.1 mediumEPSS 0.12%

• 2026-09-03

  CVE-2026-84966 BSON element injection via NUL-embedded document keys in builder append

  CVSS 5.1 mediumEPSS 0.14%

• 2026-09-03

  CVE-2026-84969 Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output

  CVSS 3.7 lowEPSS 0.27%

• 2026-09-03

  CVE-2026-84971 Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path

  CVSS 6.5 mediumEPSS 0.26%

• 2026-09-03

  CVE-2026-84970 Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser

  CVSS 6.2 mediumEPSS 0.12%

• 2026-08-28

  CVE-2026-81533 MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values

  CVSS 7.1 highEPSS 0.37%

• 2026-08-28

  CVE-2026-81532 BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption

  CVSS 8.8 highEPSS 0.49%

• 2026-08-28

  CVE-2026-81520 MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion

  CVSS 7.5 highEPSS 0.42%

• 2026-08-28

  CVE-2026-81518 BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

  CVSS 7.5 highEPSS 0.25%

• 2026-08-28

  CVE-2026-81517 MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service

  CVSS 7.5 highEPSS 0.46%

• 2026-08-28

  CVE-2026-81490 MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service

  CVSS 7.7 highEPSS 0.47%

• 2026-08-28

  CVE-2026-77586 MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output

  CVSS 8.0 highEPSS 0.42%

• 2026-08-28

  CVE-2026-77184 MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output

  CVSS 5.2 mediumEPSS 0.30%

• 2026-08-28

  CVE-2026-76798 MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports

  CVSS 6.3 mediumEPSS 0.29%

• 2026-08-28

  CVE-2026-76797 MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports

  CVSS 6.3 mediumEPSS 0.35%

• 2026-08-28

  CVE-2026-76794 MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata

  CVSS 4.6 mediumEPSS 0.23%

• 2026-08-27

  CVE-2026-81530 KMS master key exposure via unredacted credential serialization in driver settings string

  CVSS 5.6 mediumEPSS 0.10%

• 2026-08-27

  CVE-2026-81529 Connection-option injection via unescaped settings in the canonical MongoDB URL builder

  CVSS 7.1 highEPSS 0.29%

• 2026-08-27

  CVE-2026-81528 NoSQL injection via array replacement bypassing update shape validation in driver write path

  CVSS 5.4 mediumEPSS 0.28%

• 2026-08-27

  CVE-2026-81527 NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation

  CVSS 6.5 mediumEPSS 0.31%

• 2026-08-27

  CVE-2026-81526 Cross-database write redirection via unvalidated dotted database name in bulk write namespaces

  CVSS 6.5 mediumEPSS 0.40%

• 2026-08-27

  CVE-2026-81525 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver

  CVSS 8.1 highEPSS 0.49%

• 2026-08-27

  CVE-2026-81524 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver

  CVSS 5.4 mediumEPSS 0.27%

• 2026-08-27

  CVE-2026-81523 Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt

  CVSS 4.4 mediumEPSS 0.10%

• 2026-08-27

  CVE-2026-81522 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

  CVSS 8.1 highEPSS 0.46%

• 2026-08-27

  CVE-2026-81521 Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver

  CVSS 6.5 mediumEPSS 0.24%

• 2026-08-27

  CVE-2026-75573 MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied

  CVSS 4.4 mediumEPSS 0.12%

• 2026-08-27

  CVE-2026-75159 MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination

  CVSS 5.9 mediumEPSS 0.48%

• 2026-08-12

  CVE-2026-19003 MongoDB BI Connector ODBC driver may write outside an allocated buffer when the setup dialog opens a data source with oversized path settings

  CVSS 7.8 highEPSS 0.21%

• 2026-08-12

  CVE-2026-19004 MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters

  CVSS 8.1 highEPSS 0.50%

• 2026-08-12

  CVE-2026-18888 MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character data

  CVSS 6.5 mediumEPSS 0.42%

• 2026-08-12

  CVE-2026-19001 MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names

  CVSS 9.8 criticalEPSS 0.54%

• 2026-08-12

  CVE-2026-19002 Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver

  CVSS 8.1 highEPSS 0.40%

• 2026-08-12

  CVE-2026-19503 Insufficient OIDC endpoint validation could invoke unintended local protocol handlers

  CVSS 4.8 mediumEPSS 0.20%

• 2026-08-12

  CVE-2026-19502 Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI

  CVSS 5.5 mediumEPSS 0.18%

• 2026-08-11

  CVE-2026-18710 Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization

  CVSS 6.5 mediumEPSS 0.14%

• 2026-08-11

  CVE-2026-18712 Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections

  CVSS 8.1 highEPSS 0.24%

• 2026-08-11

  CVE-2026-18711 Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure

  CVSS 7.1 highEPSS 0.49%

• 2026-08-11

  CVE-2026-18709 Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency

  CVSS 6.4 mediumEPSS 0.19%

• 2026-08-11

  CVE-2026-18698 Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command

  CVSS 5.4 mediumEPSS 0.24%

• 2026-08-11

  CVE-2026-18690 Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections

  CVSS 8.1 highEPSS 0.41%

• 2026-08-11

  CVE-2026-18699 Improper Input Validation in MongoDB Query Planner Leads to Denial of Service

  CVSS 6.5 mediumEPSS 0.40%

• 2026-08-11

  CVE-2026-18691 Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure

  CVSS 8.8 highEPSS 0.36%

• 2026-08-11

  CVE-2026-18702 Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings

  CVSS 6.4 mediumEPSS 0.27%

• 2026-08-11

  CVE-2026-18694 Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure

  CVSS 7.1 highEPSS 0.40%

• 2026-08-11

  CVE-2026-18708 Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes

  CVSS 6.4 mediumEPSS 0.38%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)