MongoDB vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited MongoDB flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2025-14847 MongoDB and MongoDB Server Improper Handling of Length Parameter InconsistencyExploited since Dec 29, 2025 · CVSS 8.7
• CVE-2019-10758 MongoDB mongo-express Remote Code ExecutionExploited since Dec 10, 2021 · CVSS 9.9

Latest high and critical flaws

• CVE-2026-116641 The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store.High 7.6 · Oct 28, 2026
• CVE-2026-118510 A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiledHigh 7.7 · Oct 28, 2026
• CVE-2026-115930 The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store.High 7.6 · Oct 26, 2026
• CVE-2026-115929 MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store.High 7.6 · Oct 23, 2026
• CVE-2026-114653 A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as High 7.1 · Oct 22, 2026
• CVE-2026-114652 A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be iHigh 7.1 · Oct 22, 2026
• CVE-2026-114649 The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections.High 7.6 · Oct 22, 2026
• CVE-2026-114648 The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before plaHigh 7.2 · Oct 22, 2026
• CVE-2026-114644 The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type.High 8.2 · Oct 22, 2026
• CVE-2026-113870 MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source.High 8.6 · Oct 21, 2026
• CVE-2026-112368 An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary documenHigh 8.2 · Oct 19, 2026
• CVE-2026-96299 A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos procHigh 7.1 · Oct 13, 2026
• CVE-2026-104005 A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the mongos procHigh 7.1 · Oct 13, 2026
• CVE-2026-104004 MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator.High 7.1 · Oct 13, 2026
• CVE-2026-107325 Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.VHigh 8.2 · Oct 8, 2026
• CVE-2026-107324 An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON High 8.2 · Oct 8, 2026
• CVE-2026-106433 Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document contaiHigh 8.7 · Oct 8, 2026
• CVE-2026-106429 An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process.High 7.1 · Oct 8, 2026
• CVE-2026-96749 An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built frHigh 7.5 · Sep 24, 2026
• CVE-2026-96748 PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters.High 8.3 · Sep 24, 2026
• CVE-2026-96750 MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that dataHigh 7.3 · Sep 24, 2026
• CVE-2026-96746 An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responHigh 8.3 · Sep 24, 2026
• CVE-2026-96744 Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplHigh 7.1 · Sep 24, 2026
• CVE-2026-93764 Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema.High 7.1 · Sep 18, 2026
• CVE-2026-93763 A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-sideHigh 7.1 · Sep 18, 2026