DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
MongoDB Server: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-09-08
Ein Angreifer kann mehrere Schwachstellen in MongoDB Server ausnutzen, um erweiterte Berechtigungen, einschließlich Administratorrechte, zu erlangen und beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
01
beschreibt (23)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-82076US | — | — | ||
An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resou… | ||||
| CVE-2026-82074US | —OT erhöht | — | ||
MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggrega… | ||||
| CVE-2026-82073US | —OT erhöht | — | ||
A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data fro… | ||||
| CVE-2026-82071US | — | — | ||
Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection… | ||||
| CVE-2026-82070US | — | — | ||
A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from conc… | ||||
| CVE-2026-82069US | medium6.5 | — | ||
A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' o… | ||||
| CVE-2026-82068US | — | — | ||
A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write com… | ||||
| CVE-2026-82067US | — | — | ||
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during… | ||||
| CVE-2026-82066US | high8.1 | — | ||
A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the sec… | ||||
| CVE-2026-82065US | — | — | ||
A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service.… | ||||
| CVE-2026-82064US | — | — | ||
A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in… | ||||
| CVE-2026-82063US | — | — | ||
A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions dur… | ||||
| CVE-2026-82062US | —OT erhöht | — | ||
A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an interna… | ||||
| CVE-2026-82061US | — | — | ||
A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memor… | ||||
| CVE-2026-82060US | — | — | ||
In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as… | ||||
| CVE-2026-82059US | medium6.5 | — | ||
An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations.… | ||||
| CVE-2026-82058US | — | — | ||
A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing… | ||||
| CVE-2026-82057US | — | — | ||
A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage co… | ||||
| CVE-2026-82056US | — | — | ||
A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operat… | ||||
| CVE-2026-82055US | — | — | ||
A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is ins… | ||||
20 von 23 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- EU Vulnerability Database EUVD-2026-72913 vom 2026-09-08external
- EU Vulnerability Database EUVD-2026-72914 vom 2026-09-08external
- EU Vulnerability Database EUVD-2026-72915 vom 2026-09-08external
- EU Vulnerability Database EUVD-2026-72916 vom 2026-09-08external
- EU Vulnerability Database EUVD-2026-72917 vom 2026-09-08external
- EU Vulnerability Database EUVD-2026-72919 vom 2026-09-08external
- EU Vulnerability Database EUVD-2026-72939 vom 2026-09-08external
- EU Vulnerability Database EUVD-2026-72940 vom 2026-09-08external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan