← Back to CVE List
CVE-2026-8053NVD
Vulnerability Summary
An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution.
This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
CVSS v4.0 Base Metrics — Score 8.7 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredLow
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)High
Availability (Vulnerable System)High
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
CVSS v3.1 Base Metrics — Score 8.8 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Affected & Patched Versions
- MongoDB, Inc. MongoDB Server >= 5.0 and < 5.0.33
- MongoDB, Inc. MongoDB Server >= 6.0 and < 6.0.28
- MongoDB, Inc. MongoDB Server >= 7.0 and < 7.0.34
- MongoDB, Inc. MongoDB Server >= 8.0 and < 8.0.23
- MongoDB, Inc. MongoDB Server >= 8.2 and < 8.2.9
- MongoDB, Inc. MongoDB Server >= 8.3 and < 8.3.2
- MongoDB, Inc. MongoDB Server 5.0.33
- MongoDB, Inc. MongoDB Server 6.0.28
- MongoDB, Inc. MongoDB Server 7.0.34
- MongoDB, Inc. MongoDB Server 8.0.23
- MongoDB, Inc. MongoDB Server 8.2.9
- MongoDB, Inc. MongoDB Server 8.3.2