CVE-2026-18687

MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://jira.mongodb.org/browse/SERVER-130628	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mongodb:mongodb::::::::
	cpe:2.3:a:mongodb:mongodb::::::::
	cpe:2.3:a:mongodb:mongodb::::::::
	cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:::-:-::
	cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:::-:-::
	cpe:2.3:a:mongodb:mongodb:9.1.0:alpha0:::-:-::

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El manejo por parte del servidor MongoDB de una operación de mantenimiento de Cifrado Consultable no validó correctamente ciertos parámetros de solicitud contra la configuración de campo cifrado de la colección antes de su uso. Un usuario autenticado con privilegios de lectura/escritura podría enviar una solicitud especialmente formada que conduce a una caída del servidor o escrituras internas excesivas, lo que resulta en agotamiento de recursos y corrupción de datos de índice cifrados.

16 Sep 2026, 15:14

Type	Values Removed	Values Added
CPE		cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:::-:-:: cpe:2.3:a:mongodb:mongodb:9.1.0:alpha0:::-:-:: cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:::-:-:: cpe:2.3:a:mongodb:mongodb::::::::
References	~~() https://jira.mongodb.org/browse/SERVER-130628 -~~	() https://jira.mongodb.org/browse/SERVER-130628 - Vendor Advisory
First Time		Mongodb Mongodb mongodb

Information

Published : 2026-08-11 19:17

Updated : 2026-10-23 21:10

NVD link : CVE-2026-18687

Mitre link : CVE-2026-18687

CVE.ORG link : CVE-2026-18687

JSON object : View

Products Affected

mongodb

mongodb

CWE

CWE-191

Integer Underflow (Wrap or Wraparound)

{"id": "CVE-2026-18687", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18687", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T20:27:09.476812Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@mongodb.com", "affectedData": [{"vendor": "MongoDB", "product": "MongoDB Server", "versions": [{"status": "affected", "version": "8.3.0", "lessThan": "8.3.8", "versionType": "semver"}, {"status": "affected", "version": "8.0", "lessThan": "8.0.29", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T19:17:22.467", "references": [{"url": "https://jira.mongodb.org/browse/SERVER-130628", "tags": ["Vendor Advisory"], "source": "cna@mongodb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@mongodb.com", "description": [{"lang": "en", "value": "CWE-191"}]}], "descriptions": [{"lang": "en", "value": "MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data."}, {"lang": "es", "value": "El manejo por parte del servidor MongoDB de una operaci\u00f3n de mantenimiento de Cifrado Consultable no valid\u00f3 correctamente ciertos par\u00e1metros de solicitud contra la configuraci\u00f3n de campo cifrado de la colecci\u00f3n antes de su uso. Un usuario autenticado con privilegios de lectura/escritura podr\u00eda enviar una solicitud especialmente formada que conduce a una ca\u00edda del servidor o escrituras internas excesivas, lo que resulta en agotamiento de recursos y corrupci\u00f3n de datos de \u00edndice cifrados."}], "lastModified": "2026-10-23T21:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DC64BC6-1D47-4809-9616-95A7CF59DC37", "versionEndExcluding": "8.0.29", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BCD6B05-9FD5-4283-A2AC-8B625425597F", "versionEndIncluding": "8.2.12", "versionStartIncluding": "8.2.0"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EE4503A-F53C-432E-9DDB-F488DD989E8A", "versionEndExcluding": "8.3.8", "versionStartIncluding": "8.3.0"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:*:*:-:-:*:*", "vulnerable": true, "matchCriteriaId": "0FB52026-6C88-4401-84B5-3A070F0906D4"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:*:*:-:-:*:*", "vulnerable": true, "matchCriteriaId": "8D32A105-731C-493E-8CBF-639204CDAC7C"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:9.1.0:alpha0:*:*:-:-:*:*", "vulnerable": true, "matchCriteriaId": "D56E512D-83F8-4D51-8690-E92F6A006822"}], "operator": "OR"}]}], "sourceIdentifier": "cna@mongodb.com"}