Total 149 security vulnerabilities recorded for mongodb software and firmware.
prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause ...
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stag...
In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for...
"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB...
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Wind...
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected appli...
The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a n...
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' ...
A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to eit...
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an excep...
An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object ...
Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and ma...
MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, i...
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connecti...
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affec...
The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets w...
Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The pub...
If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work...
In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin...
MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves....
Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which m...
An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may resul...
It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow due to the ...
An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to res...