Is MongoDB 8.2.6 affected?

Vulnerabilities affecting 8.2.6

• 8.8
  CVE-2026-18692 An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory ha…
• 8.8
  CVE-2026-18691 An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects…
• 8.8
  CVE-2026-11933 A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able t… fixed in 8.2.11
• 8.8
  CVE-2026-8053 An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The is… fixed in 8.2.9
• 8.1
  CVE-2026-82053 A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations.…
• 8.1
  CVE-2026-18712 An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruct…
• 8.1
  CVE-2026-18690 An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not…
• 8.1
  CVE-2026-13072 When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potenti… fixed in 8.2.12
• 8.1
  CVE-2026-13059 An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain… fixed in 8.2.12
• 8.1
  CVE-2026-9753 The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApp… fixed in 8.2.10
• 7.7
  CVE-2026-13078 A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files… fixed in 8.2.12
• 7.6
  CVE-2026-18693 An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain do…
• 7.5
  CVE-2026-18697 An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation com…
• 7.5
  CVE-2026-9740 A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain… fixed in 8.2.10
• 7.5
  CVE-2026-9742 When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command… fixed in 8.2.10
• 7.5
  CVE-2026-8336 After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the… fixed in 8.2.9
• 7.1
  CVE-2026-18711 An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been f…
• 7.1
  CVE-2026-18694 An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without pr…
• 7.1
  CVE-2026-18687 MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An…
• 7.1
  CVE-2026-18688 An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregati…
• 7.1
  CVE-2026-13077 A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an… fixed in 8.2.12
• 6.5
  CVE-2026-82070 A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administra…
• 6.5
  CVE-2026-82076 An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submit… fixed in 8.2.13
• 6.5
  CVE-2026-82054 A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parse…
• 6.5
  CVE-2026-18705 An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlyi…
• 6.5
  CVE-2026-18699 An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query…
• 6.5
  CVE-2026-18700 An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, thro…
• 6.5
  CVE-2026-18701 An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filt…
• 6.5
  CVE-2026-18695 An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to…
• 6.5
  CVE-2026-18696 An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying col…
• 6.5
  CVE-2026-9737 During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to in…
• 6.5
  CVE-2026-13075 An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in th… fixed in 8.2.12
• 6.5
  CVE-2026-13069 An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used… fixed in 8.2.12
• 6.5
  CVE-2026-13071 An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory… fixed in 8.2.12
• 6.5
  CVE-2026-13062 An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by send… fixed in 8.2.12
• 6.5
  CVE-2026-13064 Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The… fixed in 8.2.12
• 6.5
  CVE-2026-13065 A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to termin… fixed in 8.2.12
• 6.5
  CVE-2026-13066 Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the cli… fixed in 8.2.12
• 6.5
  CVE-2026-13055 The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, trig… fixed in 8.2.12
• 6.5
  CVE-2026-13058 An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue… fixed in 8.2.12
• 6.5
  CVE-2026-13060 An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stag… fixed in 8.2.12
• 6.5
  CVE-2026-9754 An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command fixed in 8.2.10
• 6.5
  CVE-2026-9747 Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server. fixed in 8.2.10
• 6.5
  CVE-2026-9748 The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mecha… fixed in 8.2.10
• 6.5
  CVE-2026-9749 This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces… fixed in 8.2.10
• 6.5
  CVE-2026-9750 An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from… fixed in 8.2.10
• 6.5
  CVE-2026-9752 An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-… fixed in 8.2.10
• 6.5
  CVE-2026-9741 A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields… fixed in 8.2.10
• 6.5
  CVE-2026-9746 When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which causes the server to crash. There are no special privileges needed. The user… fixed in 8.2.10
• 6.5
  CVE-2026-8199 An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure an… fixed in 8.2.9
• 6.5
  CVE-2026-8063 An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an empty pipeline on a view. When resolving a view, the server inspects the aggregation pipeline to determine w… fixed in 8.2.7
• 6.5
  CVE-2026-6914 Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoDB server. This issue affects all MongoDB Server v8.2 versions, all MongoDB Se… fixed in 8.2.7
• 6.4
  CVE-2026-18708 An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, thr…
• 6.4
  CVE-2026-18709 An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transact…
• 6.4
  CVE-2026-18702 An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intend…
• 6.4
  CVE-2026-8201 A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability r… fixed in 8.2.9
• 6.3
  CVE-2026-6915 An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect… fixed in 8.2.7
• 5.5
  CVE-2026-9751 The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text. fixed in 8.2.10
• 5.4
  CVE-2026-18698 An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileg…
• 5.3
  CVE-2026-13074 An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's… fixed in 8.2.12
• 5.3
  CVE-2026-13070 A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is en… fixed in 8.2.12
• 5.3
  CVE-2026-13057 An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use inter… fixed in 8.2.12
• 4.3
  CVE-2026-18707 An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggre…
• 4.3
  CVE-2026-13063 An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocry… fixed in 8.2.12
• 4.3
  CVE-2026-8202 Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilizat… fixed in 8.2.9
• 4.2
  CVE-2026-18703 An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an adminis…
• 4.2
  CVE-2026-13068 An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for… fixed in 8.2.12
• 2.7
  CVE-2026-8200 When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted.  This… fixed in 8.2.9

Newer releases