MongoDB Patches 27 Vulnerabilities, Including Memory Corruption, RBAC Bypass, and a Compass Command Injection
Do Son 
TL;DR
MongoDB disclosed 27 vulnerabilities across MongoDB Server and the Compass GUI client. Most are denial-of-service bugs, but several allow access-control bypass, information disclosure, or memory corruption. No exploitation in the wild has been confirmed for this set.
- Total: 27 CVEs
- Severity: 1 Critical · 19 High · 7 Medium
- Actively exploited: None confirmed
- Highest severity: 9.2 (Critical · CVSSv4) — CVE-2026-13072
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-13072 | 9.2 | Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption | 7.0.39, 8.0.28, 8.2.12 (+1) | Not exploited |
| CVE-2026-11933 | 8.7 | Post-authentication use-after-free in server-side JavaScript BSON-to-array conversion | — | Not exploited |
| CVE-2026-13059 | 8.6 | Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass | 7.0.39, 8.0.28, 8.2.12 (+1) | Not exploited |
| CVE-2026-14881 | 8.4 | Compass connection import allows to override OIDC browser open command (usually set through settings), allowing for arbitrary shell commands execution when connecting to cluster using OIDC auth flow | 1.49.7 | Not exploited |
| CVE-2026-13067 | 7.2 | tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket | 8.0.28, 8.3.7 | Not exploited |
| CVE-2026-13077 | 7.1 | Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data | 7.0.39, 8.0.28, 8.2.12 (+1) | Not exploited |
| CVE-2026-13066 | 7.1 | Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure | 7.0.39, 8.0.28, 8.2.12 (+1) | Not exploited |
| CVE-2026-13078 | 6.3 | Local File Disclosure in via MozJS Scripting Engine Module Loader | 7.0.39, 8.0.28, 8.2.12 (+1) | Not exploited |
Why It Matters
MongoDB runs behind countless web and cloud applications. A crash on the database means downtime for every app that depends on it. Worse, several of these MongoDB vulnerabilities let a low-privilege user read or change data they should never touch. That breaks the access model teams rely on for tenant isolation.
The Most Serious Flaws
Memory corruption and memory safety
CVE-2026-13072 is the highest-rated bug at CVSS 9.2. It causes memory corruption when Compute Mode processes external BSON data. That mode is off by default and must be enabled at startup, which limits exposure. CVE-2026-11933, at CVSS 8.8, is a use-after-free in the server-side JavaScript engine. It can leak process memory or crash the server. CVE-2026-13077 adds an out-of-bounds heap read through malformed BSONColumn data.
Access-control bypass
Several MongoDB vulnerabilities weaken authorization. CVE-2026-13059 (CVSS 8.6) lets a low-privilege user bypass role-based, query-level controls on find, update, delete, and aggregate. CVE-2026-13057 and CVE-2026-13060 expose collection data through crafted search and $graphLookup requests. CVE-2026-13061 leaks other users’ session metadata.
Compass command execution
CVE-2026-14881 (CVSS 8.4) sits in the Compass desktop client. A crafted connection import can override the OIDC browser-open command. As a result, connecting to a cluster can run arbitrary shell commands.
How the Attacks Work
Most server flaws share one pattern. An authenticated user sends a crafted aggregation pipeline or command, and the server hits an internal check it cannot satisfy. The mongod process then terminates, which denies service to everyone.
The DoS bugs span many features. They touch $jsonSchema, $linearFill, $rankFusion, $scoreFusion, transactions, and Queryable Encryption payloads. One flaw, CVE-2026-13074, stands apart. An unauthenticated client can abuse the awaitable hello command in exhaust mode to burn CPU. Information-disclosure bugs round out the list, including a local file read through the MozJS module loader (CVE-2026-13078).
Affected Versions
The server flaws affect the 7.0, 8.0, 8.2, and 8.3 release lines, though the exact range varies per CVE. Compass is affected from 1.38.0 up to 1.49.7. Not every CVE hits every branch, so check each advisory against your deployment.
Patch and Mitigation Steps
Upgrade to the fixed releases: MongoDB Server 7.0.39, 8.0.28, 8.2.12, or 8.3.7. The memory-safety fix for CVE-2026-11933 landed in earlier 8.0 patch releases, so confirm your build against each advisory. Compass users should move to 1.49.7 or later.
Some steps reduce risk in the meantime. Keep Compute Mode and server-side JavaScript disabled unless you truly need them. Apply least privilege so ordinary accounts cannot run broad aggregation queries. Track new fixes through the official MongoDB security alerts page, and never import connection files from untrusted sources into Compass.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
