MongoDB: 25 Vulnerabilities Disclosed, Including Critical BI Connector Flaws
A batch of 25 vulnerabilities in MongoDB products, including critical memory corruption flaws in the BI Connector and denial-of-service risks in the Server, were disclosed together.
Key findings
- 25 MongoDB vulnerabilities disclosed together, impacting Server, BI Connector, and Schema Manager.
- Critical flaw (CVE-2026-19001) in BI Connector ODBC Driver allows memory corruption via buffer overflow.
- Multiple MongoDB Server vulnerabilities lead to DoS, data corruption, and unauthorized access.
- Plaintext logging of credentials and sensitive connection settings in SQL Schema Builder and drivers.
- Patching is recommended across affected MongoDB products to address memory safety and access control issues.
On August 11 and 12, 2026, a significant batch of 25 vulnerabilities was disclosed across various MongoDB products, including the MongoDB Server, BI Connector ODBC Driver, and Schema Manager. These vulnerabilities, ranging in severity from Medium (CVSSv3 4.2) to Critical (CVSSv3 9.8), were disclosed in close succession, indicating a coordinated disclosure event. The issues primarily affect authenticated users and can lead to denial-of-service conditions, memory corruption, unauthorized data access, and in some cases, potential code execution.
Several vulnerabilities in the MongoDB BI Connector ODBC Driver involve memory-safety issues due to improper buffer handling when processing data such as file paths, stored procedure metadata, or long catalog/schema/object names. CVE-2026-19001, a critical vulnerability, can lead to memory corruption within the calling application's process due to an out-of-bounds write when handling unusually long names. CVE-2026-19003 and CVE-2026-19004 also detail out-of-bounds writes related to file paths and stored procedure parameters, respectively. CVE-2026-18888 describes a similar issue where floating-point values are converted to text without adequate buffer checking.
Within the MongoDB Server, multiple vulnerabilities were disclosed. CVE-2026-18711 and CVE-2026-18700 describe use-after-free vulnerabilities that could lead to server crashes or unintended code execution, affecting time-series collections and geospatial validation, respectively. Several other MongoDB Server vulnerabilities focus on denial-of-service (DoS) conditions. CVE-2026-18707, CVE-2026-18701, and CVE-2026-18699 allow authenticated users to cause unexpected server termination through crafted aggregation commands, query filters, or queries against text-indexed collections. CVE-2026-18697, however, allows an unauthenticated party to cause a mongos router process to terminate.
Other MongoDB Server issues include insufficient validation leading to unauthorized data modification or access. CVE-2026-18712 allows an authenticated user to modify data in different collections, while CVE-2026-18704 permits authenticated users with read privileges to perform unauthorized write operations. CVE-2026-18705 enables authenticated users to retrieve data from protected views, and CVE-2026-18698 could expose metadata or allow unauthorized modifications on system collections. Additionally, CVE-2026-18703 highlights an issue where certificate-based authentication might be allowed even when restricted, and CVE-2026-18702 details how authenticated users could modify diagnostic logging settings server-wide. CVE-2026-18709 describes a flaw in transaction coordination, potentially leading to data inconsistency.
The MongoDB Schema Manager and Atlas SQL ODBC Driver are also affected. CVE-2026-19503 indicates that these components do not validate OIDC discovery document endpoints, potentially leading to URI dispatch to uncontrolled deployments. Furthermore, CVE-2026-19502 reveals that the MongoDB SQL Schema Builder CLI logs sensitive connection settings in plaintext to standard output or log files when file logging is enabled. CVE-2026-18710 points to a similar issue where a MongoDB driver component writes sensitive configuration information, including credentials, to logs in cleartext.
These vulnerabilities were patched by MongoDB. Users are advised to consult MongoDB's official advisories for specific version information and recommended upgrade paths. The coordinated disclosure of these numerous vulnerabilities underscores the importance of timely patching and security reviews for complex database systems like MongoDB.
The disclosure of these vulnerabilities highlights potential risks associated with buffer overflows, use-after-free conditions, insufficient access control, and insecure handling of sensitive information within MongoDB products. Users should prioritize updating their MongoDB deployments to the latest patched versions to mitigate these risks and ensure the integrity and availability of their data. The range of affected components, from core server functionality to specific drivers and management tools, necessitates a comprehensive review of security postures across the entire MongoDB ecosystem. </sup>,cve_ids:[