Quick answers
- Is CVE-2026-82069 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82069 being exploited in the wild.
- How severe is CVE-2026-82069?
- Low severity, with a CVSS score of 2.7, published 8 September 2026.
- Which products and versions are affected?
- MongoDB Server before 8.3.9, 9.0.0-rc3, and 9.1.0-rc0.
- Is there a fix for CVE-2026-82069?
- A patch was published on 2026-09-08: Fix versions released: 8.3.9, 9.0.0-rc3, 9.1.0-rc0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82069 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-82069?
- Check whether you run MongoDB or MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an information disclosure in MongoDB Server's query statistics serialization layer when processing $search aggregation stages through a mongos router. An improper conditional check in the redaction logic fails to anonymize native $search queries, causing raw, unredacted query text to be recorded in query statistics instead of the expected anonymized form ({$search: "?object"}). The flaw only affects queries routed through mongos; direct mongod connections properly anonymize the data. An attacker requires monitoring privileges to access the query statistics interface and view the leaked query text. The issue has been fixed in versions 8.3.9, 9.0.0-rc3, and later.
Affected products
- MongoDB MongoDB Server before 8.3.9, 9.0.0-rc3, and 9.1.0-rc0
Timeline
- 2026-09-08: disclosed: CVE-2026-82069 published
- 2026-09-08: patched: Fix versions released: 8.3.9, 9.0.0-rc3, 9.1.0-rc0