MongoDB vulnerabilities
We track 134 vulnerabilities in MongoDB products across 40 products. 134 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 13, 2026.
Latest MongoDB vulnerabilities
- 8.8 High severity
mongosh: Improper Neutralization of Escape, Meta, or Control Sequences
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfu
- 8.1 High severity
MongoDB Server: Improper Neutralization of Null Byte or NUL Character
An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , Mo
- 9.8 Critical severity
MongoDB Server: Use of Uninitialized Resource
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3.
- 7.8 High severity
MongoDB Server: Improper Access Control
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted
- 7.5 High severity
MongoDB Rust Driver: Improper Handling of Syntactically Invalid Structure
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.
- 9.8 Critical severity
MongoDB Compass: Improper Control of Generation of Code
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2
- 8.1 High severity
PyMongo: Out-of-bounds Read
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
- 7.5 High severity
Improper validation of certain metadata input may result in the server not correctly…
Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause unexpected application behavior including unavailability of serverStatus responses. This issue affects
- 9.8 Critical severity
MongoDB Server: Improper Certificate Validation
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that
- 7.5 High severity
MongoDB C Driver: Loop with Unreachable Exit Condition
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.
- 7.5 High severity
MongoDB Atlas Kubernetes Operator: Insertion of Sensitive Information into Log File
The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.
- 7.5 High severity
MongoDB Server: Improper Certificate Validation
If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely in other platforms (e.g. Linux), it is possible that client certificate validation may not be in eff
- 7.2 High severity
MongoDB Ops Manager: Improper Privilege Management
In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.
- 7.2 High severity
MongoDB .NET/C# Driver: Deserialization of Untrusted Data
Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all Mong