MongoDB Server Vulnerability Allowing Unauthorized Access to Protected Collections
CVE-2026-18698

5.3MEDIUM

Key Information:

Vendor

Mongodb
Status
Mongodb Server
Vendor
CVE Published:
11 August 2026

What is CVE-2026-18698?

An identified issue in MongoDB Server allows authenticated users with limited database-scoped roles to interact with protected system collections. This security flaw potentially exposes sensitive metadata and may permit unauthorized modifications to system collection data, depending on specific deployment configurations. Proper access controls and privilege validation are crucial to mitigate risks associated with this vulnerability.

Affected Version(s)

MongoDB Server 8.3.0 < 8.3.8

MongoDB Server 8.0 < 8.0.29

MongoDB Server 7.0 < 7.0.40

References

https://jira.mongodb.org/browse/SERVER-130481

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.