Companies/MongoDB Atlas/CVEs

MongoDB Atlas CVEs

277 vulnerabilities mapped to MongoDB Atlas’s software or packages, 2 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-08-11

  CVE-2026-18696 Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections

  CVSS 6.5 mediumEPSS 0.40%

• 2026-08-11

  CVE-2026-18700 Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service

  CVSS 6.5 mediumEPSS 0.40%

• 2026-08-11

  CVE-2026-18701 Type Confusion in MongoDB Query Subsystem Leads to Denial of Service

  CVSS 6.5 mediumEPSS 0.40%

• 2026-08-11

  CVE-2026-18697 Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos

  CVSS 7.5 highEPSS 0.44%

• 2026-08-11

  CVE-2026-18693 Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure

  CVSS 7.6 highEPSS 0.34%

• 2026-08-11

  CVE-2026-18705 Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data

  CVSS 6.5 mediumEPSS 0.36%

• 2026-08-11

  CVE-2026-18704 Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations

  CVSS 6.5 mediumEPSS 0.29%

• 2026-08-11

  CVE-2026-18692 Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution

  CVSS 8.8 highEPSS 0.58%

• 2026-08-11

  CVE-2026-18688 Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure

  CVSS 7.1 highEPSS 0.40%

• 2026-08-11

  CVE-2026-18695 Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service

  CVSS 6.5 mediumEPSS 0.40%

• 2026-08-11

  CVE-2026-18687 Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption

  CVSS 7.1 highEPSS 0.23%

• 2026-08-11

  CVE-2026-18706 Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution

  CVSS 6.6 mediumEPSS 0.47%

• 2026-08-11

  CVE-2026-18707 Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service

  CVSS 4.3 mediumEPSS 0.35%

• 2026-08-11

  CVE-2026-18703 Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method

  CVSS 4.2 mediumEPSS 0.14%

• 2026-07-22

  CVE-2026-14881 Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow

  CVSS 7.8 highEPSS 0.21%

• 2026-07-22

  CVE-2026-13055 Server crash via aggregation pipeline expression with compound wildcard index specification

  CVSS 6.5 mediumEPSS 0.40%

• 2026-07-22

  CVE-2026-13056 A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM

  CVSS 6.5 mediumEPSS 0.40%

• 2026-07-22

  CVE-2026-13057 Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META

  CVSS 5.3 mediumEPSS 0.35%

• 2026-07-22

  CVE-2026-13058 Transaction Command Insufficient Input Validation Leading to Process Termination

  CVSS 6.5 mediumEPSS 0.40%

• 2026-07-22

  CVE-2026-13059 Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass

  CVSS 8.1 highEPSS 0.38%

• 2026-07-22

  CVE-2026-9737 Find command with $meta sort can lead to crash

  CVSS 6.5 mediumEPSS 0.42%

• 2026-07-22

  CVE-2026-13060 $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access

  CVSS 6.5 mediumEPSS 0.43%

• 2026-07-22

  CVE-2026-13061 Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage

  CVSS 4.3 mediumEPSS 0.28%

• 2026-07-22

  CVE-2026-13062 MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

  CVSS 6.5 mediumEPSS 0.19%

• 2026-07-22

  CVE-2026-13063 libmongocrypt Improper Input Validation Leading to Process Termination

  CVSS 4.3 mediumEPSS 0.40%

• 2026-07-22

  CVE-2026-13064 MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service

  CVSS 6.5 mediumEPSS 0.45%

• 2026-07-22

  CVE-2026-13065 MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

  CVSS 6.5 mediumEPSS 0.50%

• 2026-07-22

  CVE-2026-13066 Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure

  CVSS 6.5 mediumEPSS 0.37%

• 2026-07-22

  CVE-2026-13067 tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket

  CVSS 6.3 mediumEPSS 0.10%

• 2026-07-22

  CVE-2026-13068 MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse

  CVSS 4.2 mediumEPSS 0.25%

• 2026-07-22

  CVE-2026-13069 Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion

  CVSS 6.5 mediumEPSS 0.29%

• 2026-07-22

  CVE-2026-13070 Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination

  CVSS 5.3 mediumEPSS 0.13%

• 2026-07-22

  CVE-2026-13071 Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination

  CVSS 6.5 mediumEPSS 0.42%

• 2026-07-22

  CVE-2026-13072 MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption

  CVSS 8.1 highEPSS 0.40%

• 2026-07-22

  CVE-2026-13073 MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination

  CVSS 4.3 mediumEPSS 0.37%

• 2026-07-22

  CVE-2026-13074 Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service

  CVSS 5.3 mediumEPSS 0.44%

• 2026-07-22

  CVE-2026-13075 $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation

  CVSS 6.5 mediumEPSS 0.42%

• 2026-07-22

  CVE-2026-13076 Aggregation Framework Memory Exhaustion Leading to Process Termination

  CVSS 6.5 mediumEPSS 0.42%

• 2026-07-22

  CVE-2026-13077 Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data

  CVSS 7.1 highEPSS 0.42%

• 2026-07-22

  CVE-2026-13078 Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

  CVSS 7.7 highEPSS 0.37%

• 2026-06-12

  CVE-2026-11933 Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion

  CVSS 8.8 highEPSS 0.38%

• 2026-06-09

  CVE-2026-9740 Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow

  CVSS 7.5 highEPSS 0.34%

• 2026-06-09

  CVE-2026-9735 Keyfile contents are in MongoDB Server logs

  CVSS 5.5 mediumEPSS 0.12%

• 2026-06-09

  CVE-2026-9754 Stack memory disclosure in filemd5 command

  CVSS 6.5 mediumEPSS 0.22%

• 2026-06-09

  CVE-2026-9753 Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.

  CVSS 8.1 highEPSS 0.30%

• 2026-06-09

  CVE-2026-9752 GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation

  CVSS 6.5 mediumEPSS 0.27%

• 2026-06-09

  CVE-2026-9751 Sensitive data could be written to mongod.log

  CVSS 5.5 mediumEPSS 0.11%

• 2026-06-09

  CVE-2026-9750 Metadata name collision on $-prefixed fields causes post-auth server crash

  CVSS 6.5 mediumEPSS 0.37%

• 2026-06-09

  CVE-2026-9749 Using MaxKey() may crash the server

  CVSS 6.5 mediumEPSS 0.27%

• 2026-06-09

  CVE-2026-9748 $_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input

  CVSS 6.5 mediumEPSS 0.32%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)