Executive brief
MongoDB Server's encrypted data feature (Queryable Encryption) failed to properly validate certain maintenance operation requests, allowing authenticated users to crash the database or cause excessive internal data writes. This vulnerability can lead to service downtime, resource exhaustion, and corruption of the encrypted index structures that protect sensitive data.
Technical details
The vulnerability exists in MongoDB Server's handling of Queryable Encryption (FLE2) compaction operations, which fail to properly validate request parameters against the collection's encrypted field configuration before processing. An authenticated user with readWrite privileges can exploit this by submitting a specially crafted request that triggers either a server crash or excessive range padding insertions into the Encrypted State Collection (ESC), resulting in resource exhaustion and index data corruption. The attack requires authentication and database write access. Patches are available in versions 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0.
Affected products
- MongoDB Server before 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0
Timeline
- 2026-08-11: disclosed: CVE-2026-18687 published
- 2026-08-11: patched: Patches released in versions 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0