CVE-2026-8053

An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution. This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://jira.mongodb.org/browse/SERVER-126021	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mongodb:mongodb::::::::
	cpe:2.3:a:mongodb:mongodb::::::::
	cpe:2.3:a:mongodb:mongodb::::::::
	cpe:2.3:a:mongodb:mongodb::::::::
	cpe:2.3:a:mongodb:mongodb::::::::
	cpe:2.3:a:mongodb:mongodb::::::::

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Un problema en la implementación de colecciones de series temporales del servidor MongoDB permite a un usuario autenticado con privilegios de escritura en la base de datos desencadenar una escritura de memoria fuera de límites en el proceso mongod. El problema se debe a una inconsistencia en el mapeo interno de nombre de campo a índice dentro del catálogo de cubos de series temporales. Bajo ciertas condiciones, esto puede resultar en ejecución de código arbitrario. Este problema afecta a las versiones v5.0 del servidor MongoDB anteriores a la 5.0.33, las versiones v6.0 anteriores a la 6.0.28, las versiones v7.0 anteriores a la 7.0.34, las versiones v8.0 anteriores a la 8.0.23, las versiones v8.2 anteriores a la 8.2.9 y las versiones v8.3 anteriores a la 8.3.2.

Information

Published : 2026-05-13 04:17

Updated : 2026-10-26 18:10

NVD link : CVE-2026-8053

Mitre link : CVE-2026-8053

CVE.ORG link : CVE-2026-8053

JSON object : View

Products Affected

mongodb

mongodb

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-8053", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8053", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-13T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@mongodb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@mongodb.com", "affectedData": [{"vendor": "MongoDB, Inc.", "product": "MongoDB Server", "versions": [{"status": "affected", "version": "5.0", "lessThan": "5.0.33", "versionType": "custom"}, {"status": "affected", "version": "6.0", "lessThan": "6.0.28", "versionType": "custom"}, {"status": "affected", "version": "7.0", "lessThan": "7.0.34", "versionType": "custom"}, {"status": "affected", "version": "8.0", "lessThan": "8.0.23", "versionType": "custom"}, {"status": "affected", "version": "8.2", "lessThan": "8.2.9", "versionType": "custom"}, {"status": "affected", "version": "8.3", "lessThan": "8.3.2", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-13T04:17:41.287", "references": [{"url": "https://jira.mongodb.org/browse/SERVER-126021", "tags": ["Patch", "Vendor Advisory"], "source": "cna@mongodb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@mongodb.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution.\n\nThis issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2."}, {"lang": "es", "value": "Un problema en la implementaci\u00f3n de colecciones de series temporales del servidor MongoDB permite a un usuario autenticado con privilegios de escritura en la base de datos desencadenar una escritura de memoria fuera de l\u00edmites en el proceso mongod. El problema se debe a una inconsistencia en el mapeo interno de nombre de campo a \u00edndice dentro del cat\u00e1logo de cubos de series temporales. Bajo ciertas condiciones, esto puede resultar en ejecuci\u00f3n de c\u00f3digo arbitrario.\n\nEste problema afecta a las versiones v5.0 del servidor MongoDB anteriores a la 5.0.33, las versiones v6.0 anteriores a la 6.0.28, las versiones v7.0 anteriores a la 7.0.34, las versiones v8.0 anteriores a la 8.0.23, las versiones v8.2 anteriores a la 8.2.9 y las versiones v8.3 anteriores a la 8.3.2."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7011EA7-A3F9-48DD-B45F-FFDE25E90D15", "versionEndExcluding": "5.0.33", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11BDA550-A8B9-4E82-8A3E-34FC2D51C8D0", "versionEndExcluding": "6.0.28", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4708E981-6632-4230-84D7-EE8C62894498", "versionEndExcluding": "7.0.34", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30E205BF-46B1-4A0A-B8C4-82CD711E52D6", "versionEndExcluding": "8.0.23", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89C71FA9-6CE2-4AAC-9133-A2D6304518DF", "versionEndExcluding": "8.2.9", "versionStartIncluding": "8.2.0"}, {"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1A1DA38-4609-42A0-8541-8519794BCD9C", "versionEndExcluding": "8.3.2", "versionStartIncluding": "8.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@mongodb.com"}