CVE-2026-18701Medium· 6.5▾ SunlitAn issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of ser…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.4%
An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.
mongodb >= 7.0.0, < 7.0.40mongodb >= 8.0.0, < 8.0.29mongodb >= 8.2.0, <= 8.2.12mongodb >= 8.3.0, < 8.3.8mongodb = 9.0.0mongodb = 9.1.0Upgrade past the affected range:
mongodb 8.3.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82057Medium· 6.5A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process
CVE-2026-8843Medium· 6.5Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server
CVE-2026-84967Medium· 4.3A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal
CVE-2026-82052Medium· 6.5The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod)
CVE-2026-82053High· 8.1A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations
CVE-2026-82054Medium· 6.5A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing