# MongoDB Server vulnerabilities Source: https://junglewise.ai/threats/technologies/mongodb-server Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/mongodb-server.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 86 vulnerabilities in MongoDB Server: 20 in the last 7 days and 36 in the last 90 days, 2 of them critical and 1 exploited in the wild. The most recent, CVE-2026-120825, was published on 10 November 2026. 3 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 20 - Last 30 days: 20 - Last 90 days: 36 - All time: 86 (2 critical, 1 exploited in the wild) ## About MongoDB Server A document-oriented NoSQL database program that uses JSON-like documents with optional schemas. ## Latest MongoDB Server vulnerabilities - [CVE-2026-120825: MongoDB Server authorization bypass in aggregation pipeline](https://junglewise.ai/threats/cve-2026-120825-an-authorization-weakness-in-the-aggregation-framework-of) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-120824: MongoDB Server use-after-free in time-series bucket validation](https://junglewise.ai/threats/cve-2026-120824-a-use-after-free-in-the-time-series-collection-component-of) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-120823: MongoDB Server missing authorization check in aggregation framework](https://junglewise.ai/threats/cve-2026-120823-a-missing-authorization-check-in-the-aggregation-framework-of) (medium, CVSS 4.3, published 10 Nov 2026) - [CVE-2026-120822: MongoDB Server authorization bypass in applyOps](https://junglewise.ai/threats/cve-2026-120822-mongodb-server-may-omit-an-authorization-check-on-the-resource) (medium, CVSS 6.7, published 10 Nov 2026) - [CVE-2026-120821: MongoDB Server use-after-free in aggregation framework](https://junglewise.ai/threats/cve-2026-120821-a-use-after-free-in-the-aggregation-framework-of-mongodb-server) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-120820: MongoDB Server memory exhaustion in FLE2 operation statistics](https://junglewise.ai/threats/cve-2026-120820-mongodb-server-maintains-an-in-memory-table-of-per-namespace) (medium, CVSS 4.3, published 10 Nov 2026) - [CVE-2026-120819: MongoDB Server memory disclosure in JavaScript execution](https://junglewise.ai/threats/cve-2026-120819-a-memory-management-flaw-in-the-server-side-javascript-execution) (medium, CVSS 4.3, published 10 Nov 2026) - [CVE-2026-120818: MongoDB Server use-after-free in server-side JavaScript aggregation](https://junglewise.ai/threats/cve-2026-120818-a-use-after-free-weakness-in-mongodb-server-s-server-side) (high, CVSS 7.1, published 10 Nov 2026) - [CVE-2026-120817: MongoDB Server race condition in schema validation](https://junglewise.ai/threats/cve-2026-120817-a-race-condition-in-the-schema-validation-component-of-mongodb) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-118383: MongoDB Server use-after-free in replication catch-up](https://junglewise.ai/threats/cve-2026-118383-a-use-after-free-in-the-replication-component-of-mongodb-server) (critical, CVSS 9, published 10 Nov 2026) - [CVE-2026-120815: MongoDB Server authorization bypass via localhost exception](https://junglewise.ai/threats/cve-2026-120815-an-incorrect-authorization-check-in-the-mongodb-server) (high, CVSS 8.4, published 10 Nov 2026) - [CVE-2026-120814: MongoDB Server privilege escalation in sharding subsystem](https://junglewise.ai/threats/cve-2026-120814-an-improper-privilege-management-issue-in-the-sharding-subsystem) (high, CVSS 7.2, published 10 Nov 2026) - [CVE-2026-120813: MongoDB Server client-side field-level encryption schema parsing bypass](https://junglewise.ai/threats/cve-2026-120813-an-issue-in-mongodb-server-s-client-side-field-level-encryption) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-120812: MongoDB Server denial of service in query processing](https://junglewise.ai/threats/cve-2026-120812-an-issue-in-mongodb-server-s-query-processing-component-allows) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-120811: MongoDB Server use-after-free in query plan cache](https://junglewise.ai/threats/cve-2026-120811-a-use-after-free-issue-exists-in-the-mongodb-server-s-classic) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-120810: MongoDB server denial of service in aggregation framework](https://junglewise.ai/threats/cve-2026-120810-an-issue-in-mongodb-server-s-aggregation-framework-allows-an) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-120809: MongoDB use-after-free read in SBE aggregation pipeline](https://junglewise.ai/threats/cve-2026-120809-a-use-after-free-read-issue-exists-in-mongodb-s-sbe-slot-based) (medium, CVSS 6.8, published 10 Nov 2026) - [CVE-2026-120807: MongoDB X.509 cluster authentication privilege escalation](https://junglewise.ai/threats/cve-2026-120807-a-flaw-in-mongodb-s-x-509-cluster-membership-authentication) (medium, CVSS 6.6, published 10 Nov 2026) - [CVE-2026-120806: MongoDB Server incomplete role cleanup in user management](https://junglewise.ai/threats/cve-2026-120806-a-flaw-in-mongodb-server-s-user-management-commands-may-lead-to) (medium, CVSS 5.5, published 10 Nov 2026) - [CVE-2026-120805: MongoDB Server Queryable Encryption metadata authorization bypass](https://junglewise.ai/threats/cve-2026-120805-in-mongodb-server-an-authenticated-user-with-insert-privileges) (medium, CVSS 4.3, published 10 Nov 2026) - [CVE-2026-96297: MongoDB Server use-after-free in aggregation pipeline](https://junglewise.ai/threats/cve-2026-96297-use-of-freed-memory-in-the-aggregation-feature-of-mongodb-server) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-104004: MongoDB Server denial of service in collection validation](https://junglewise.ai/threats/cve-2026-104004-mongodb-server-s-collection-validation-feature-may-not-properly) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-103965: MongoDB Server aggregation framework constant value handling in query rewriting](https://junglewise.ai/threats/cve-2026-103965-an-issue-in-mongodb-server-s-aggregation-framework-can-cause) (medium, CVSS 5.4, published 13 Oct 2026) - [CVE-2026-89099: MongoDB Server race condition in document value layer](https://junglewise.ai/threats/cve-2026-89099-a-race-condition-in-the-document-value-layer-of-mongodb-server) (high, CVSS 7.5, published 11 Sep 2026) - [CVE-2026-82076: MongoDB Server integer overflow in query planner](https://junglewise.ai/threats/cve-2026-82076-mongodb-server-integer-overflow-in-query-planner) (medium, CVSS 6.5, published 8 Sep 2026) ## Most severe MongoDB Server vulnerabilities - [CVE-2025-14847: MongoDB Server uninitialized heap memory disclosure in Zlib headers](https://junglewise.ai/threats/cve-2025-14847-mongodb-server-uninitialized-heap-memory-disclosure-in-zlib) (critical, exploited in the wild, CVSS 8.7, published 29 Dec 2025) - [CVE-2026-118383: MongoDB Server use-after-free in replication catch-up](https://junglewise.ai/threats/cve-2026-118383-a-use-after-free-in-the-replication-component-of-mongodb-server) (critical, CVSS 9, published 10 Nov 2026) - [CVE-2026-18691: MongoDB Server SASL mechanism downgrade in intra-cluster authentication](https://junglewise.ai/threats/cve-2026-18691-mongodb-server-sasl-mechanism-downgrade-in-intra-cluster) (high, CVSS 8.8, published 11 Aug 2026) - [CVE-2026-8053: MongoDB Server out-of-bounds write in time-series collections](https://junglewise.ai/threats/cve-2026-8053-mongodb-server-out-of-bounds-write-in-time-series-collections) (high, CVSS 8.8, published 13 May 2026) - [CVE-2026-120824: MongoDB Server use-after-free in time-series bucket validation](https://junglewise.ai/threats/cve-2026-120824-a-use-after-free-in-the-time-series-collection-component-of) (high, CVSS 8.8, published 10 Nov 2026) - [CVE-2026-11933: MongoDB Server use-after-free in server-side JavaScript engine](https://junglewise.ai/threats/cve-2026-11933-mongodb-server-use-after-free-in-server-side-javascript-engine) (high, CVSS 8.8, published 12 Jun 2026) - [CVE-2026-120815: MongoDB Server authorization bypass via localhost exception](https://junglewise.ai/threats/cve-2026-120815-an-incorrect-authorization-check-in-the-mongodb-server) (high, CVSS 8.4, published 10 Nov 2026) - [CVE-2026-82053: MongoDB LDAP connection pooling privilege escalation](https://junglewise.ai/threats/cve-2026-82053-mongodb-ldap-connection-pooling-privilege-escalation) (high, CVSS 8.1, published 8 Sep 2026) - [CVE-2026-13072: MongoDB Server heap overflow in aggregation pipeline processing](https://junglewise.ai/threats/cve-2026-13072-mongodb-server-heap-overflow-in-aggregation-pipeline-processing) (high, CVSS 8.1, published 22 Jul 2026) - [CVE-2026-13059: MongoDB Server authorization bypass in query-level access controls](https://junglewise.ai/threats/cve-2026-13059-mongodb-server-authorization-bypass-in-query-level-access) (high, CVSS 8.1, published 22 Jul 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 13 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 20 | 1 | 0 | ## Other MongoDB technologies - [MongoDB C Driver](https://junglewise.ai/threats/technologies/c-driver): 41 vulnerabilities - [MongoDB](https://junglewise.ai/threats/technologies/mongodb): 25 vulnerabilities - [MongoDB Connector for BI](https://junglewise.ai/threats/technologies/connector-for-bi): 8 vulnerabilities - [MongoDB Bi Connector Odbc Driver](https://junglewise.ai/threats/technologies/bi-connector-odbc-driver): 7 vulnerabilities - [MongoDB Mongoid](https://junglewise.ai/threats/technologies/mongoid): 7 vulnerabilities - [MongoDB PHP Driver](https://junglewise.ai/threats/technologies/php-driver): 7 vulnerabilities - [MongoDB Compass](https://junglewise.ai/threats/technologies/compass): 6 vulnerabilities - [MongoDB Libmongocrypt](https://junglewise.ai/threats/technologies/libmongocrypt): 6 vulnerabilities - [MongoDB Python Driver](https://junglewise.ai/threats/technologies/mongodb-python-driver): 6 vulnerabilities - [MongoDB Go Driver](https://junglewise.ai/threats/technologies/go-driver): 5 vulnerabilities - [MongoDB Mongo-Express](https://junglewise.ai/threats/technologies/mongo-express): 5 vulnerabilities - [MongoDB Node.js Driver](https://junglewise.ai/threats/technologies/node-js-driver): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "MongoDB Server vulnerabilities", https://junglewise.ai/threats/technologies/mongodb-server, 13 November 2026.