MongoDB Server: High and Medium Severity Vulnerabilities Disclosed Together
Three MongoDB Server vulnerabilities, including one High severity flaw, were disclosed on August 11, 2026, potentially causing server crashes and denial-of-service for authenticated users.
Key findings
- Three MongoDB Server vulnerabilities disclosed on August 11, 2026, including one High and two Medium severity flaws.
- Vulnerabilities impact authenticated users and can lead to server crashes or denial-of-service conditions.
- CVE-2026-18711 involves memory corruption in the query execution engine for time-series collections.
- CVE-2026-18700 affects geospatial validation through concurrent operations.
- CVE-2026-18699 allows denial of service via specially crafted queries on collections with text indexes.
On August 11, 2026, a batch of three vulnerabilities was disclosed for MongoDB Server, with a High severity rating and two Medium severity ratings. These vulnerabilities, all disclosed simultaneously, primarily impact authenticated users and could lead to server crashes or denial-of-service conditions. The disclosures highlight potential weaknesses in MongoDB's query execution, geospatial validation, and query planning components.
One of the disclosed vulnerabilities, CVE-2026-18711, is rated High with a CVSSv3 score of 7.1. This issue resides within MongoDB Server's query execution engine. An authenticated user possessing read and write privileges can exploit this flaw by running specific queries against time-series collections. The vulnerability involves the use of an internal reference after its associated memory has been freed, potentially leading to a server crash or the disclosure of sensitive information.
Two Medium severity vulnerabilities, CVE-2026-18700 and CVE-26-18699, were also disclosed on the same date. CVE-2026-18700, with a CVSSv3 score of 6.5, is found in MongoDB Server's geospatial validation. An authenticated user with write privileges can trigger this vulnerability through concurrent operations on a collection that uses a specific type of validator. Similar to CVE-2026-18711, this can result in a server crash or data leakage due to the use of a freed memory reference.
CVE-2026-18699, also rated Medium with a CVSSv3 score of 6.5, affects MongoDB Server's query planner. An authenticated user with read-level privileges can exploit this by submitting a specially crafted query against a collection that has a text index. This exploit can cause the server process to terminate unexpectedly, leading to a denial of service for connected clients and ongoing operations.
The disclosed vulnerabilities primarily affect authenticated users, requiring specific privilege levels (read/write or read) and particular configurations (time-series collections, geospatial validation with specific validators, or collections with text indexes) to be exploited. The common theme across these vulnerabilities is the potential for memory corruption or unexpected process termination, leading to service disruption.
MongoDB has addressed these vulnerabilities. Users are advised to update to the latest patched versions to mitigate these risks. Specific version information for the fix is available in MongoDB's official security advisories.
This batch of disclosures underscores the importance of regular security patching and auditing for database systems like MongoDB. While these vulnerabilities require authenticated access, their potential to cause crashes and data disclosure necessitates prompt attention from administrators to ensure the stability and integrity of their data environments. Users should consult MongoDB's official advisories for detailed mitigation steps and recommended versions.