CVE-2026-13058 is a high-severity vulnerability that allows an authenticated user with basic write privileges to cause the mongod process to terminate abnormally. This is achieved by sending a crafted transaction command with an incomplete set of required fields, resulting in a fatal internal invariant failure and denial of service. The vulnerability affects MongoDB-like systems and has a CVSS score of 7. [truncated]
An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due to insufficient input validation, an authenticated client can supply these fields directly. This vulnerability h [truncated]
CVE-2026-9101 describes a prototype pollution flaw in CSV parsing during import. Under specific user actions, the issue can cause untrusted file paths — not arbitrary arguments — to reach shell.openExternal, which can result in one-click command execution in the affected desktop workflow.
CVE-2026-9100 describes a flaw in the MongoDB C Driver’s legacy GridFS API where malformed file metadata from the database is not validated adequately. If an application reads a crafted GridFS document through that legacy API, the result can be a denial of service crash (division-by-zero) or a silent memory disclosure via out-of-bounds read. NVD published the CVE on 2026-05-20 and listed the issue as Awai [truncated]
The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI. The vulnerability has a CVSS score of 8.6 and is classified as HIGH severity. Affected users should review and [truncated]
