Executive brief
A security vulnerability in MongoDB Server allows a user with basic read permissions to access small amounts of sensitive information from the server's memory. By sending a specially crafted command, an attacker could potentially view data that was not intended for them, which might include internal system details. This issue has been addressed in recent software updates.
Technical details
A use of uninitialized variable vulnerability (CWE-457) exists in the MongoDB 'filemd5' command. An authenticated attacker with 'read' role privileges can trigger this flaw by issuing specially crafted commands over the network. This results in the disclosure of limited amounts of uninitialized stack memory to the attacker. The issue is fixed in MongoDB versions 8.2.10, 8.3.0-rc4, and 9.0.0-rc0.
Affected products
- MongoDB MongoDB Server Versions prior to 8.2.10, 8.3.0-rc4, and 9.0.0-rc0
Timeline
- 2026-03-20: other: Issue reported to MongoDB internally
- 2026-04-01: patched: Issue resolved in development branch
- 2026-06-09: disclosed: CVE published and NVD entry created