Companies/MongoDB Atlas/CVEs

MongoDB Atlas CVEs

277 vulnerabilities mapped to MongoDB Atlas’s software or packages, 2 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-06-09

  CVE-2026-9747 Crafted cross-shard merge aggregation crashes MongoDB Server

  CVSS 6.5 mediumEPSS 0.27%

• 2026-06-09

  CVE-2026-9746 Server crashes in case of the use of exchange

  CVSS 6.5 mediumEPSS 0.27%

• 2026-06-09

  CVE-2026-9743 Aggregation sub-pipeline null dereference may allow DoS via crafted getMore

  CVSS 6.5 mediumEPSS 0.31%

• 2026-06-09

  CVE-2026-9742 Authenticate command with specific mechanism parameter can trigger server crash

  CVSS 7.5 highEPSS 0.35%

• 2026-06-09

  CVE-2026-9741 Client side encryption fails to encrypt values in a $vectorSearch

  CVSS 6.5 mediumEPSS 0.10%

• 2026-05-20

  CVE-2026-9101 Prototype pollution in csv parsing

  CVSS 4.3 mediumEPSS 0.41%

• 2026-05-20

  CVE-2026-9100 Heap memory out of bounds read and crash in C Driver legacy GridFS file reader

  CVSS 5.9 mediumEPSS 0.30%

• 2026-05-18

  CVE-2026-8843 Calling createIndex with certain index types can crash mongod

  CVSS 6.5 mediumEPSS 0.24%

• 2026-05-14

  CVE-2026-6811 PHP Stack Exhaustion

  CVSS 5.9 mediumEPSS 0.37%

• 2026-05-13

  CVE-2026-8202 Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators

  CVSS 4.3 mediumEPSS 0.26%

• 2026-05-13

  CVE-2026-8336 Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands

  CVSS 7.5 highEPSS 0.26%

• 2026-05-13

  CVE-2026-8201 Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields

  CVSS 6.4 mediumEPSS 0.13%

• 2026-05-13

  CVE-2026-8200 Schema validation log messages may not redact user data

  CVSS 2.7 lowEPSS 0.20%

• 2026-05-13

  CVE-2026-8199 Post-auth memory exhaustion via bitwise match expressions

  CVSS 6.5 mediumEPSS 0.26%

• 2026-05-12

  CVE-2026-8053 FlatBSON Duplicate Field Index Drift

  CVSS 8.8 highEPSS 0.66%

• 2026-05-12

  CVE-2026-8431 Ops Manager RCE via webhook body

  CVSS 7.2 highEPSS 0.37%

• 2026-05-07

  CVE-2026-8063 Post-auth null pointer dereference when aggregating against a view with empty search pipeline

  CVSS 6.5 mediumEPSS 0.23%

• 2026-05-06

  CVE-2026-6691 MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow

  CVSS 7.8 highEPSS 0.13%

• 2026-04-29

  CVE-2026-6915 Flaw in the updateUser Command May Allow Unauthorized Configuration Change

  CVSS 6.3 mediumEPSS 0.17%

• 2026-04-29

  CVE-2026-6914 MD5 checksum creation may cause availability loss

  CVSS 6.5 mediumEPSS 0.26%

• 2026-04-13

  CVE-2026-6231 bson_validate may skip validation when processing certain inputs

  CVSS 4.3 mediumEPSS 0.18%

• 2026-03-30

  CVE-2026-5170 Users could trigger a crash of mongod primaries during promotion to sharded

  CVSS 5.3 mediumEPSS 0.20%

• 2026-03-17

  CVE-2026-4359 Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer

  CVSS 2.0 lowEPSS 0.19%

• 2026-03-17

  CVE-2026-4358 Memory safety issues in slot-based execution hash table spill

  CVSS 6.4 mediumEPSS 0.36%

• 2026-03-17

  CVE-2026-4148 ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators

  CVSS 8.8 highEPSS 0.34%

• 2026-03-17

  CVE-2026-4147 Stack memory disclosure in filemd5 command

  CVSS 6.5 mediumEPSS 0.22%

• 2026-02-10

  CVE-2026-2303 Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak

  CVSS 6.5 mediumEPSS 0.32%

• 2026-02-10

  CVE-2026-2302 Unsafe Reflection in Mongoid::Criteria.from_hash

  CVSS 6.5 mediumEPSS 0.23%

• 2026-02-10

  CVE-2026-25613 An unsafe cast in the MongoDB query planner can result in a segmentation fault.

  CVSS 6.5 mediumEPSS 0.28%

• 2026-02-10

  CVE-2026-1849 Mongod can run out of stack memory when expressions create deeply nested documents

  CVSS 6.5 mediumEPSS 0.32%

• 2026-02-10

  CVE-2026-1850 An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification

  CVSS 6.5 mediumEPSS 0.28%

• 2026-02-10

  CVE-2026-25609 profile command may permit unauthorized configuration

  CVSS 5.4 mediumEPSS 0.20%

• 2026-02-10

  CVE-2026-25610 Invalid $geoNear index hint may cause server crash

  CVSS 6.5 mediumEPSS 0.28%

• 2026-02-10

  CVE-2026-1848 Connections received from the proxy port may not count towards total accepted connections

  CVSS 7.5 highEPSS 0.30%

• 2026-02-10

  CVE-2026-1847 MongoDB Server may crash when inserting large documents

  CVSS 6.5 mediumEPSS 0.28%

• 2026-02-10

  CVE-2026-25612 Internal ResourceId collision may affect unrelated collections

  CVSS 6.5 mediumEPSS 0.23%

• 2026-02-10

  CVE-2026-25611 Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server

  CVSS 7.5 highEPSS 0.86%

• 2026-01-27

  CVE-2025-14911 Integer Overflow in GridFS chunkSize Leading to Heap Allocation Failure

  CVSS 6.5 mediumEPSS 0.33%

• 2025-12-19

  CVE-2025-14847 Zlib compressed protocol header length confusion may allow memory read

  CVSS 7.5 highKEV added 2025-12-29EPSS 83.2%1 incident

• 2025-12-09

  CVE-2025-14345 Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server

  CVSS 4.2 mediumEPSS 0.22%

• 2025-11-25

  CVE-2025-13644 MongoDB may be susceptible to Invariant Failure due to batched delete

  CVSS 6.5 mediumEPSS 0.33%

• 2025-11-25

  CVE-2025-13643 MongoDB Server may allow queries to be terminated by unauthorized users

  CVSS 3.1 lowEPSS 0.22%

• 2025-11-25

  CVE-2025-12893 Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server

  CVSS 4.2 mediumEPSS 0.09%

• 2025-11-25

  CVE-2025-13507 Time-series operations may cause internal BSON size limit to be exceed

  CVSS 6.5 mediumEPSS 0.29%

• 2025-11-18

  CVE-2025-12119 Bulk write with options may read invalid memory

  CVSS 6.8 mediumEPSS 0.21%

• 2025-11-03

  CVE-2025-12657 Malformed KMIP response may result in access violation

  CVSS 5.0 mediumEPSS 0.39%

• 2025-10-23

  CVE-2025-12100 MongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directories

  CVSS 7.8 highEPSS 0.17%

• 2025-10-23

  CVE-2025-11575 MongoDB Atlas SQL ODBC driver installation via MSI may leave ACLs unset on custom installation directories

  CVSS 7.8 highEPSS 0.14%

• 2025-10-20

  CVE-2025-11979 Use-after-free in the MongoDB server query planner may lead to crash or undefined behavior

  CVSS 5.3 mediumEPSS 0.27%

• 2025-10-13

  CVE-2025-11695 Configuration may unexpectedly disable certificate validation

  CVSS 8.0 highEPSS 0.18%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)