Executive brief
MongoDB Server includes a Queryable Encryption feature that allows users to encrypt sensitive data at the application level while still querying it. The maintenance operations for this feature (compact and cleanup) contain an authorization flaw that allows an authenticated user with limited administrative privileges over one encrypted collection to destroy or corrupt encrypted data in other collections belonging to different users. An attacker with a minimal service account can permanently delete victim data by exploiting insufficient validation of metadata references.
Technical details
The vulnerability is an authorization bypass in MongoDB's Queryable Encryption maintenance commands (compactStructuredEncryptionData and cleanupStructuredEncryptionData). The root cause is that the commands perform authorization checks only on the primary encrypted data collection (EDC) namespace, but then derive and operate on secondary namespaces (ESC and ECOC collections) without re-authorizing those operations. An attacker with compactStructuredEncryptionData privilege on a single EDC can manipulate the stored encryptedFieldConfig to point the ESC or ECOC references to victim collections, then trigger compaction to perform rename, drop, and bulk-delete operations on those victim collections without any authorization check. This requires an authenticated account with the compactStructuredEncryptionData privilege and the ability to modify metadata (e.g., via createCollection with crafted encryptedFields). The fix involves raising the authorization scope from exact-namespace to database-wide scope before performing derived namespace operations.
Affected products
- MongoDB Server 7.0 before 7.0.40, 8.0 before 8.0.29, 8.2 before 8.2.13, 8.3 before 8.3.8, 9.0 before 9.0.0-rc2
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched: Patches available for 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0