MongoDB Patches 32 Vulnerabilities, Including CVE-2026-19001 Arbitrary Code Execution Flaw (CVSS 9.5)

TL;DR: MongoDB security vulnerabilities now total 32 disclosed flaws across MongoDB Server, the BI Connector ODBC Driver, Atlas SQL ODBC Driver, and Schema Builder CLI. The most severe, CVE-2026-19001, carries a CVSS score of 9.5 and can lead to arbitrary code execution. MongoDB has released patches for every affected component.

Notable CVEs

Why It Matters

Attackers who successfully trigger CVE-2026-19001 could execute arbitrary code within an application using the BI Connector ODBC Driver. That level of access lets an attacker corrupt memory or crash the process. In the worst case, code runs with the privileges of the logged-in user. Three related flaws in the same driver, CVE-2026-19002, CVE-2026-19004, and CVE-2026-18888, involve similar buffer-overflow patterns. At least six of the 32 flaws mention potential code execution as a possible outcome under certain conditions. Independent researchers at ThreatInt and other trackers confirmed these same buffer-overflow mechanics after MongoDB’s disclosure.

Beyond the driver bugs, MongoDB Server patches close authorization gaps in several commands. Those gaps could let a limited user tamper with data outside their assigned collections.

How the Attack Works

Most of the critical flaws share a common root cause: missing bounds checks. The BI Connector ODBC Driver accepts long file paths, object names, or stored-procedure metadata without confirming they fit inside a fixed-size buffer. When the input exceeds that size, the driver writes past the buffer’s edge and corrupts adjacent memory. Depending on what sits nearby, the corruption can crash the application. In rarer cases, it lets an attacker influence what code runs next.

Server-side, several flaws stem from authorization checks that verify the wrong resource. A user with permission on one collection or view can sometimes reach a different, protected one. The server checks the wrong internal reference before running the requested operation.

Affected Versions

The BI Connector ODBC Driver flaws affect every release before version 1.4.9. MongoDB Server versions 7.0, 8.0, and 8.3 also received fixes, landing in 7.0.40, 8.0.29, and 8.3.8 respectively. The Atlas SQL ODBC Driver needed an update to 2.0.9, and the Schema Builder CLI moved to 1.2.1. Each fix is cumulative, so upgrading to the listed version resolves every flaw disclosed in this batch. MongoDB’s own security alerts page lists the exact build for every affected product.

Patch and Mitigation Steps

Administrators should update every affected MongoDB product to its patched version right away. Several of these MongoDB security vulnerabilities require no special privileges to trigger. Patching should not wait for a routine maintenance window. Security teams should prioritize the driver and OIDC-related fixes first, since those pose the most direct risk. Teams that cannot patch the BI Connector immediately should avoid connecting it to untrusted database servers. A malicious server is what triggers most of the driver flaws. Reviewing role assignments also helps, since many of the server-side bugs only affect certain scoped roles. No source has confirmed active exploitation of any of these 32 CVEs at the time of writing.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.