# CVE-2026-82069: MongoDB Server query statistics serialization information disclosure

Source: https://junglewise.ai/threats/cve-2026-82069-mongodb-server-query-statistics-serialization-information  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82069 · Severity: low · CVSS 2.7 · Published 2026-09-08

MongoDB Server has a flaw in how it handles search query statistics on sharded clusters. Users with monitoring access can see unredacted search query text from other users' operations, potentially exposing sensitive data embedded in search queries. This bypasses MongoDB's normal data protection controls for query statistics.

Technologies: [MongoDB](https://junglewise.ai/threats/technologies/mongodb), [MongoDB Server](https://junglewise.ai/threats/technologies/mongodb-server). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-82069 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82069 being exploited in the wild.

**How severe is CVE-2026-82069?** Low severity, with a CVSS score of 2.7, published 8 September 2026.

**Which products and versions are affected?** MongoDB Server before 8.3.9, 9.0.0-rc3, and 9.1.0-rc0.

**Is there a fix for CVE-2026-82069?** A patch was published on 2026-09-08: Fix versions released: 8.3.9, 9.0.0-rc3, 9.1.0-rc0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82069 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-82069?** Check whether you run MongoDB or MongoDB Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an information disclosure in MongoDB Server's query statistics serialization layer when processing $search aggregation stages through a mongos router. An improper conditional check in the redaction logic fails to anonymize native $search queries, causing raw, unredacted query text to be recorded in query statistics instead of the expected anonymized form ({$search: "?object"}). The flaw only affects queries routed through mongos; direct mongod connections properly anonymize the data. An attacker requires monitoring privileges to access the query statistics interface and view the leaked query text. The issue has been fixed in versions 8.3.9, 9.0.0-rc3, and later.

## Affected products

- MongoDB MongoDB Server before 8.3.9, 9.0.0-rc3, and 9.1.0-rc0

## Timeline

- 2026-09-08: disclosed: CVE-2026-82069 published
- 2026-09-08: patched: Fix versions released: 8.3.9, 9.0.0-rc3, 9.1.0-rc0

## References

- [https://jira.mongodb.org/browse/SERVER-132835](https://jira.mongodb.org/browse/SERVER-132835)

## Related threats

- [MongoDB replica-set denial of service via unreclaimed wait records](https://junglewise.ai/threats/cve-2026-120828-a-replica-set-database-server-node-does-not-limit-or-reclaim)
- [MongoDB Server authorization bypass in aggregation pipeline](https://junglewise.ai/threats/cve-2026-120825-an-authorization-weakness-in-the-aggregation-framework-of)
- [MongoDB Server use-after-free in time-series bucket validation](https://junglewise.ai/threats/cve-2026-120824-a-use-after-free-in-the-time-series-collection-component-of)
- [MongoDB Server missing authorization check in aggregation framework](https://junglewise.ai/threats/cve-2026-120823-a-missing-authorization-check-in-the-aggregation-framework-of)
- [MongoDB Server authorization bypass in applyOps](https://junglewise.ai/threats/cve-2026-120822-mongodb-server-may-omit-an-authorization-check-on-the-resource)