CVE-2026-18712: MongoDB Improper Authorization Vulnerability in Queryable Encryption Maintenance Operations
Summary
CVE-2026-18712: An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging t... Affects mongodb across 3 version ranges.
>= 7.0.0, < 7.0.40
>= 8.0.0, < 8.0.29
>= 8.2.0, < 8.3.8
Fixed in 7.0.40, 8.0.29 or 8.3.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MongoDB is a widely used NoSQL database that allows for flexible data storage and retrieval. It supports various data models and is known for its scalability and performance. However, like any software, it can have vulnerabilities. The specific issue at hand involves improper authorization in its Queryable Encryption feature, which is designed to protect sensitive data. This vulnerability can lead to unauthorized modifications of data across different collections, posing a significant risk to data integrity and security.
Vulnerability Detail
The vulnerability arises from insufficient validation of internal metadata references within MongoDB's Queryable Encryption maintenance operations. An authenticated user with privileges on one encrypted collection could exploit this flaw to modify or destroy data in another collection. This could lead to data loss, corruption, or unauthorized access to sensitive information, severely impacting the integrity of the database.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.0.407.0.40 -
>= 8.0.0, < 8.0.298.0.29 -
>= 8.2.0, < 8.3.88.3.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider restricting access to the Queryable Encryption feature until the patch is applied. This can be done by modifying user roles and permissions to limit access to sensitive operations.
Conclusion
CVE-2026-18712 is a significant vulnerability in MongoDB that can lead to unauthorized data modifications across collections. It is crucial to update to the patched versions to ensure the security and integrity of your database. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for mongodb →
FAQ
CVE-2026-18712 is a vulnerability in MongoDB that allows unauthorized modification of data across collections due to improper authorization in Queryable Encryption maintenance operations.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. By uploading your manifest file like package-lock.json, you can check if your application is affected by this vulnerability.
The risks include unauthorized data modification, data loss, and potential exposure of sensitive information, which can severely compromise data integrity and security.
To update MongoDB, use your package manager to install the patched version (7.0.40, 8.0.29, or 8.3.8). Follow the update commands provided in the 'how_to_fix' section.
Yes, you can temporarily restrict access to the Queryable Encryption feature by modifying user roles and permissions to limit access to sensitive operations.
References
Related vulnerabilities
Recent vulnerabilities recorded for mongodb.
