MongoDB Server vulnerabilities and CVEs
Known vulnerabilities affecting MongoDB Server, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.
23 vulnerabilities tracked. 1 with public exploit code.
- 9.5 A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up.
- 9.1 An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound…
- 8.7 A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option…
- 8.7 A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket…
- 8.6 MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because…
- 8.6 An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to…
- 8.2 An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be…
- 7.5 An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level…
- 7.1 An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write…
- 7.1 An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database…
- 7.1 A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation…
- 7.1 A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously…
- 7.1 A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection…
- 7.1 An issue in MongoDB server’s aggregation framework allows an authenticated user with read privileges to cause a denial of service by…
- 7.1 A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator used by certain…
- 6.1 A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on…
- 6.0 An issue in MongoDB Server's query processing component allows an authenticated user with read privileges to cause a denial of service.
- 6.0 A use-after-free issue exists in the MongoDB server’s classic query engine plan cache.
- 5.3 A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only…
- 5.3 MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information.
- 2.3 A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an…
- 2.3 A user with basic read-tier database privileges can use an option on a server-side data-change notification feature to receive the contents…
- 2.3 In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that MongoDB Server is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other products tracked here
Windows Server 2025 (Server Core installation) Windows Server 2025 Windows 11 version 26H1 Windows 11 Version 24H2 Windows 11 Version 25H2 Windows Server 2022 Windows Server 2019 (Server Core installation) Windows Server 2019 Windows 10 Version 21H2 Linux Windows 10 Version 22H2 Windows 10 Version 1809 Windows 11 Version 23H2 Windows Server 2016 Windows Server 2016 (Server Core installation) Windows 10 Version 1607 Windows 11 Version 26H2 Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows Server 2012 Windows Server 2012 (Server Core installation) Red Hat Enterprise Linux 10