VYPR
← All advisories
High severity8.1NVD Advisory· Published Aug 11, 2026· Updated Sep 25, 2026

CVE-2026-18712

CVE-2026-18712

Description

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • MongoDB/Serverllm-fuzzy
  • MongoDB/MongoDB4 versions
    cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*range: >=7.0.0,<7.0.40
    • cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:*:*:-:-:*:*
    • cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:*:*:-:-:*:*
    • cpe:2.3:a:mongodb:mongodb:9.1.0:alpha0:*:*:-:-:*:*
  • osv-coords
    pkg:bitnami/mongodb
    Range: >= 7.0.0, < 7.0.40

Patches

Vulnerability mechanics

References

1

News mentions

1