Executive brief
MongoDB Server contains a vulnerability in its query planning component that allows authenticated users to read beyond memory buffer boundaries. An attacker with database access can craft specific queries to trigger this issue, potentially exposing sensitive data from server memory through query diagnostic output. This could lead to information disclosure of database or application secrets.
Technical details
A heap out-of-bounds read vulnerability exists in MongoDB Server's query multi-planner component, specifically in how it handles tie-break vectors during query optimization. The vulnerability is triggered through crafted query operations and requires the attacker to be authenticated with database read and write privileges. Memory contents beyond allocated buffer boundaries can be partially read and observed through diagnostic query statistics output. The issue has been fixed in versions 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0, and later releases with full backwards compatibility.
Affected products
- MongoDB Server Before 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0
Timeline
- 2026-09-08: disclosed: CVE-2026-82066 published
- 2026-09-08: patched: Fixes available in 7.0.41, 8.0.30, 8.2.13, 8.3.9, 9.0.0-rc2, 9.1.0-rc0