CVE-2026-9754

Vulnerability

A vulnerability exists in MongoDB where an authenticated user with the read role can read limited amounts of uninitialized stack memory. This is achievable by issuing specially-crafted filemd5 commands. The vulnerability affects versions prior to 8.2.10, 8.3.0-rc4, and 9.0.0-rc0 [1].

Exploitation

An attacker must first gain authenticated access to the MongoDB instance with a read role. Once authenticated, the attacker can send a specially-crafted filemd5 command. This command triggers the vulnerability, allowing the attacker to read from uninitialized stack memory [1].

Impact

Successful exploitation allows an attacker to read limited amounts of uninitialized stack memory. This could potentially lead to the disclosure of sensitive information that may have been present in that memory at the time of the read operation, depending on the data's contents and the attacker's ability to interpret it [1].

Mitigation

This vulnerability has been fixed in MongoDB versions 8.2.10, 8.3.0-rc4, and 9.0.0-rc0. Users are advised to upgrade to one of these fixed versions or later. No workarounds are mentioned in the available references [1].