# MongoDB vulnerabilities

Source: https://junglewise.ai/threats/vendors/mongodb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/mongodb.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 247 vulnerabilities in MongoDB: 32 in the last 7 days and 167 in the last 90 days, 6 of them critical and 2 exploited in the wild. The most recent, CVE-2026-126982, was published on 13 November 2026. 36 vulnerabilities in the last four weeks, up 9% on the four before (33). 0 critical against 2. 21 technologies have a page of their own.

## Counts

- Last 7 days: 32
- Last 30 days: 63
- Last 90 days: 167
- All time: 247 (6 critical, 2 exploited in the wild)

## About MongoDB

An American software company that develops and provides commercial support for the MongoDB database.

## Latest MongoDB vulnerabilities

- [CVE-2026-126982: MongoDB C# Driver BSON type allow-list bypass](https://junglewise.ai/threats/cve-2026-126982-a-type-allow-list-bypass-in-the-bson-serialization-library-of) (high, CVSS 7.5, published 13 Nov 2026)
- [CVE-2026-126839: MongoDB BSON deserialization type-restriction bypass](https://junglewise.ai/threats/cve-2026-126839-a-deserialization-type-restriction-control-in-the-bson) (medium, CVSS 4.2, published 13 Nov 2026)
- [CVE-2026-126792: libmongocrypt out-of-bounds write in key-management request builder](https://junglewise.ai/threats/cve-2026-126792-a-memory-safety-flaw-in-the-key-management-request-building) (medium, CVSS 4.7, published 13 Nov 2026)
- [CVE-2026-126823: MongoDB JDBC driver code injection via shared temp location](https://junglewise.ai/threats/cve-2026-126823-a-local-user-with-an-ordinary-account-on-the-same-host-can-place) (high, CVSS 7, published 12 Nov 2026)
- [CVE-2026-126838: MongoDB Rust Driver credential disclosure in diagnostic output](https://junglewise.ai/threats/cve-2026-126838-a-mongodb-rust-driver-component-that-holds-client-side-field) (medium, CVSS 5.5, published 12 Nov 2026)
- [CVE-2026-126837: MongoDB Node.js driver DNS SRV validation bypass](https://junglewise.ai/threats/cve-2026-126837-a-validation-flaw-in-the-dns-srv-host-discovery-of-the-mongodb) (high, CVSS 7.4, published 12 Nov 2026)
- [CVE-2026-126835: MongoDB Node.js driver OIDC bearer token disclosure to unallowed hosts](https://junglewise.ai/threats/cve-2026-126835-the-mongodb-node-js-driver-does-not-consistently-enforce-its) (medium, CVSS 6.5, published 12 Nov 2026)
- [CVE-2026-120828: MongoDB replica-set denial of service via unreclaimed wait records](https://junglewise.ai/threats/cve-2026-120828-a-replica-set-database-server-node-does-not-limit-or-reclaim) (high, CVSS 7.5, published 10 Nov 2026)
- [CVE-2026-120825: MongoDB Server authorization bypass in aggregation pipeline](https://junglewise.ai/threats/cve-2026-120825-an-authorization-weakness-in-the-aggregation-framework-of) (medium, CVSS 6.5, published 10 Nov 2026)
- [CVE-2026-120824: MongoDB Server use-after-free in time-series bucket validation](https://junglewise.ai/threats/cve-2026-120824-a-use-after-free-in-the-time-series-collection-component-of) (high, CVSS 8.8, published 10 Nov 2026)
- [CVE-2026-120823: MongoDB Server missing authorization check in aggregation framework](https://junglewise.ai/threats/cve-2026-120823-a-missing-authorization-check-in-the-aggregation-framework-of) (medium, CVSS 4.3, published 10 Nov 2026)
- [CVE-2026-120822: MongoDB Server authorization bypass in applyOps](https://junglewise.ai/threats/cve-2026-120822-mongodb-server-may-omit-an-authorization-check-on-the-resource) (medium, CVSS 6.7, published 10 Nov 2026)
- [CVE-2026-120821: MongoDB Server use-after-free in aggregation framework](https://junglewise.ai/threats/cve-2026-120821-a-use-after-free-in-the-aggregation-framework-of-mongodb-server) (medium, CVSS 6.5, published 10 Nov 2026)
- [CVE-2026-120820: MongoDB Server memory exhaustion in FLE2 operation statistics](https://junglewise.ai/threats/cve-2026-120820-mongodb-server-maintains-an-in-memory-table-of-per-namespace) (medium, CVSS 4.3, published 10 Nov 2026)
- [CVE-2026-120819: MongoDB Server memory disclosure in JavaScript execution](https://junglewise.ai/threats/cve-2026-120819-a-memory-management-flaw-in-the-server-side-javascript-execution) (medium, CVSS 4.3, published 10 Nov 2026)
- [CVE-2026-120818: MongoDB Server use-after-free in server-side JavaScript aggregation](https://junglewise.ai/threats/cve-2026-120818-a-use-after-free-weakness-in-mongodb-server-s-server-side) (high, CVSS 7.1, published 10 Nov 2026)
- [CVE-2026-120817: MongoDB Server race condition in schema validation](https://junglewise.ai/threats/cve-2026-120817-a-race-condition-in-the-schema-validation-component-of-mongodb) (medium, CVSS 6.5, published 10 Nov 2026)
- [CVE-2026-120816: MongoDB privilege escalation via change stream showSystemEvents](https://junglewise.ai/threats/cve-2026-120816-a-user-with-basic-read-tier-database-privileges-can-use-an) (medium, CVSS 4.3, published 10 Nov 2026)
- [CVE-2026-118383: MongoDB Server use-after-free in replication catch-up](https://junglewise.ai/threats/cve-2026-118383-a-use-after-free-in-the-replication-component-of-mongodb-server) (critical, CVSS 9, published 10 Nov 2026)
- [CVE-2026-120815: MongoDB Server authorization bypass via localhost exception](https://junglewise.ai/threats/cve-2026-120815-an-incorrect-authorization-check-in-the-mongodb-server) (high, CVSS 8.4, published 10 Nov 2026)
- [CVE-2026-120814: MongoDB Server privilege escalation in sharding subsystem](https://junglewise.ai/threats/cve-2026-120814-an-improper-privilege-management-issue-in-the-sharding-subsystem) (high, CVSS 7.2, published 10 Nov 2026)
- [CVE-2026-120813: MongoDB Server client-side field-level encryption schema parsing bypass](https://junglewise.ai/threats/cve-2026-120813-an-issue-in-mongodb-server-s-client-side-field-level-encryption) (medium, CVSS 5.9, published 10 Nov 2026)
- [CVE-2026-120812: MongoDB Server denial of service in query processing](https://junglewise.ai/threats/cve-2026-120812-an-issue-in-mongodb-server-s-query-processing-component-allows) (medium, CVSS 6.5, published 10 Nov 2026)
- [CVE-2026-120811: MongoDB Server use-after-free in query plan cache](https://junglewise.ai/threats/cve-2026-120811-a-use-after-free-issue-exists-in-the-mongodb-server-s-classic) (medium, CVSS 5.9, published 10 Nov 2026)
- [CVE-2026-120810: MongoDB server denial of service in aggregation framework](https://junglewise.ai/threats/cve-2026-120810-an-issue-in-mongodb-server-s-aggregation-framework-allows-an) (medium, CVSS 6.5, published 10 Nov 2026)

## Most severe MongoDB vulnerabilities

- [CVE-2025-14847: MongoDB Server uninitialized heap memory disclosure in Zlib headers](https://junglewise.ai/threats/cve-2025-14847-mongodb-server-uninitialized-heap-memory-disclosure-in-zlib) (critical, exploited in the wild, CVSS 8.7, published 29 Dec 2025)
- [CVE-2019-10758: mongo-express remote code execution in index creation](https://junglewise.ai/threats/cve-2019-10758-mongodb-mongo-express-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 30 Dec 2019)
- [CVE-2026-93762: Mongoid unsafe reflection weakness in query path for embedded documents](https://junglewise.ai/threats/cve-2026-93762-mongoid-contains-an-unsafe-reflection-weakness-in-the-query-path) (critical, CVSS 9.8, published 18 Sep 2026)
- [CVE-2026-19001: MongoDB BI Connector ODBC Driver buffer overflow in metadata functions](https://junglewise.ai/threats/cve-2026-19001-mongodb-bi-connector-odbc-driver-buffer-overflow-in-metadata) (critical, CVSS 9.8, published 12 Aug 2026)
- [CVE-2026-93765: Mongoid unsafe reflection in document persistence layer](https://junglewise.ai/threats/cve-2026-93765-mongoid-contains-an-unsafe-reflection-weakness-in-the-document) (critical, CVSS 9.1, published 18 Sep 2026)
- [CVE-2026-118383: MongoDB Server use-after-free in replication catch-up](https://junglewise.ai/threats/cve-2026-118383-a-use-after-free-in-the-replication-component-of-mongodb-server) (critical, CVSS 9, published 10 Nov 2026)
- [CVE-2026-81532: MongoDB Connector for BI ODBC driver buffer overflow in cursor name handling](https://junglewise.ai/threats/cve-2026-81532-mongodb-connector-for-bi-odbc-driver-buffer-overflow-in-cursor) (high, CVSS 8.8, published 28 Aug 2026)
- [CVE-2026-18691: MongoDB Server SASL mechanism downgrade in intra-cluster authentication](https://junglewise.ai/threats/cve-2026-18691-mongodb-server-sasl-mechanism-downgrade-in-intra-cluster) (high, CVSS 8.8, published 11 Aug 2026)
- [CVE-2026-106433: MongoDB libmongocrypt state management memory corruption](https://junglewise.ai/threats/cve-2026-106433-improper-state-management-in-mongodb-libmongocrypt-can-cause) (high, CVSS 8.8, published 8 Oct 2026)
- [CVE-2026-8053: MongoDB Server out-of-bounds write in time-series collections](https://junglewise.ai/threats/cve-2026-8053-mongodb-server-out-of-bounds-write-in-time-series-collections) (high, CVSS 8.8, published 13 May 2026)

## Vulnerabilities per week

36 vulnerabilities in the last four weeks, up 9% on the four before (33). 0 critical against 2.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 23 | 0 | 0 |
| 31 Aug 2026 | 9 | 0 | 0 |
| 7 Sep 2026 | 34 | 0 | 0 |
| 14 Sep 2026 | 13 | 2 | 0 |
| 21 Sep 2026 | 7 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 13 | 0 | 0 |
| 12 Oct 2026 | 5 | 0 | 0 |
| 19 Oct 2026 | 16 | 0 | 0 |
| 26 Oct 2026 | 4 | 0 | 0 |
| 2 Nov 2026 | 11 | 0 | 0 |
| 9 Nov 2026 | 32 | 1 | 0 |

## MongoDB technologies

- [MongoDB Server](https://junglewise.ai/threats/technologies/mongodb-server): 86 vulnerabilities
- [MongoDB C Driver](https://junglewise.ai/threats/technologies/c-driver): 41 vulnerabilities
- [MongoDB](https://junglewise.ai/threats/technologies/mongodb): 25 vulnerabilities
- [MongoDB Connector for BI](https://junglewise.ai/threats/technologies/connector-for-bi): 8 vulnerabilities
- [MongoDB Bi Connector Odbc Driver](https://junglewise.ai/threats/technologies/bi-connector-odbc-driver): 7 vulnerabilities
- [MongoDB Mongoid](https://junglewise.ai/threats/technologies/mongoid): 7 vulnerabilities
- [MongoDB PHP Driver](https://junglewise.ai/threats/technologies/php-driver): 7 vulnerabilities
- [MongoDB Compass](https://junglewise.ai/threats/technologies/compass): 6 vulnerabilities
- [MongoDB Libmongocrypt](https://junglewise.ai/threats/technologies/libmongocrypt): 6 vulnerabilities
- [MongoDB Python Driver](https://junglewise.ai/threats/technologies/mongodb-python-driver): 6 vulnerabilities
- [MongoDB Go Driver](https://junglewise.ai/threats/technologies/go-driver): 5 vulnerabilities
- [MongoDB Mongo-Express](https://junglewise.ai/threats/technologies/mongo-express): 5 vulnerabilities
- [MongoDB Node.js Driver](https://junglewise.ai/threats/technologies/node-js-driver): 5 vulnerabilities
- [MongoDB Rust Driver](https://junglewise.ai/threats/technologies/rust-driver): 5 vulnerabilities
- [MongoDB Entity Framework Core Provider](https://junglewise.ai/threats/technologies/entity-framework-core-provider): 4 vulnerabilities
- [MongoDB Java Driver](https://junglewise.ai/threats/technologies/java-driver): 4 vulnerabilities
- [MongoDB Ops Manager](https://junglewise.ai/threats/technologies/ops-manager): 4 vulnerabilities
- [MongoDB Database Tools](https://junglewise.ai/threats/technologies/database-tools): 3 vulnerabilities
- [MongoDB Laravel MongoDB](https://junglewise.ai/threats/technologies/laravel-mongodb): 3 vulnerabilities
- [MongoDB Mongosql Transition Readiness Tool](https://junglewise.ai/threats/technologies/mongosql-transition-readiness-tool): 3 vulnerabilities
- [MongoDB PHP Library](https://junglewise.ai/threats/technologies/php-library): 3 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "MongoDB vulnerabilities", https://junglewise.ai/threats/vendors/mongodb, 13 November 2026.