MongoDB vulnerabilities
We track 134 vulnerabilities in MongoDB products across 40 products. 134 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 13, 2026.
Latest MongoDB vulnerabilities
- 8.1 High severity
Go Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated
- 8.3 High severity
Ruby Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticat
- 8.3 High severity
Python Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authentic
- 8.1 High severity
Laravel MongoDB (PHP): Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a lit
- 8.3 High severity
C# Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated
- 8.3 High severity
Rust Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticat
- 8.3 High severity
MongoDB PHP Library: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticat
- 7.7 High severity
Laravel MongoDB (PHP): Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argu
- 7.5 High severity
MongoDB Server: Allocation of Resources Without Limits or Throttling
An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause
- 8.1 High severity
MongoDB Server: Out-of-bounds Write
Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-boun
- 8.1 High severity
MongoDB Server: Improper Handling of Case Sensitivity
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment whe
- 8.1 High severity
MongoDB Server: Out-of-bounds Read
A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory
- 7.5 High severity
MongoDB Server: Reachable Assertion
A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, a
- 8.1 High severity
MongoDB Server: Use After Free
A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process cr
- 8.1 High severity
MongoDB Server: Incorrect Authorization
A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintende
- 7.5 High severity
C Driver: Double Free
A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be re
- 7.1 High severity
BI Connector ODBC Driver: Stack-based Buffer Overflow
An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional pre
- 8.8 High severity
BI Connector ODBC Driver: Stack-based Buffer Overflow
A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the dr
- 7.5 High severity
BI Connector: Synchronous Access of Remote Resource without Timeout
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time
- 7.5 High severity
BI Connector: Improper Certificate Validation
When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client
- 7.5 High severity
BI Connector: Uncaught Exception
An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operation subsequent
- 7.7 High severity
BI Connector: NULL Pointer Dereference
A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting server message
- 8.0 High severity
BI Connector: Improper Neutralization of Special Elements used in an SQL Command
In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write to
- 7.1 High severity
C# Driver: Improper Neutralization of Argument Delimiters in a Command
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client
- 8.1 High severity
PHP Library: Improper Neutralization of Special Elements in Data Query Logic
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into t
- 8.1 High severity
C++ Driver: Improper Encoding or Escaping of Output
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have it
- 7.5 High severity
BI Connector: Double Free
An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can inter
- 7.8 High severity
BI Connector ODBC Driver: Stack-based Buffer Overflow
A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's f
- 8.1 High severity
BI Connector ODBC Driver: Heap-based Buffer Overflow
An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns cra
- 8.1 High severity
BI Connector ODBC Driver: Buffer Copy without Checking Size of Input
A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects t
- 9.8 Critical severity
BI Connector ODBC Driver: Integer Overflow or Wraparound
The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling ap
- 8.1 High severity
MongoDB Server: Incorrect Authorization
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to
- 7.1 High severity
MongoDB Server: Use After Free
An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collecti
- 7.5 High severity
MongoDB Server: Reachable Assertion
An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting clie
- 7.1 High severity
MongoDB Server: Out-of-bounds Read
An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could the
- 7.6 High severity
MongoDB Server: Out-of-bounds Write
An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket
- 8.8 High severity
MongoDB Server: Use After Free
An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a serv
- 8.8 High severity
MongoDB Server: Selection of Less-Secure Algorithm During Negotiation
An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the clu
- 8.1 High severity
MongoDB Server: Incorrect Authorization
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being
- 7.1 High severity
MongoDB Server: Out-of-bounds Read
An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial