Vulnerabilities

CVE-2026-88032 is a use-after-free (CWE-416) in the reactive client-side encryption component of the MongoDB Java Driver, in which native resources can be freed while a still-running encrypted operation is using them. The issue is reachable only when the application uses a reactive encryption configuration that retrieves KMS credentials on demand, and it is triggered when an attacker or component able to cause such an in-flight encrypted operation to be cancelled does so. The result is an availability-only impact: the hosting application process can terminate, with no confidentiality or integrity loss (CVSS 4.0 vector shows VA:H with VC:N/VI:N, scored 8.2 High). Affected parties are JVM application developers embedding the MongoDB Java Driver with reactive streams plus client-side encryption and on-demand KMS credential retrieval; MongoDB deployments that do not use client-side encryption, or that use the sync/standard async drivers, are not affected. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

Do: Audit JVM applications for use of the MongoDB Java Driver's reactive streams API with client-side encryption configured to fetch KMS credentials on demand; if present, upgrade to the fixed driver version identified in MongoDB's security advisory (version numbers not provided in the available data). Until patched, limit which callers can cancel in-flight encrypted operations, and monitor MongoDB's advisory for version and mitigation details.

CVE-2026-82067 is a case-sensitivity flaw (CWE-178) in the configuration validation component of MongoDB Server: when a configuration value controlling authorization is handled case-sensitively during startup, the authorization subsystem can remain in its default disabled state. Affected deployments therefore start with authentication and authorization effectively not enforced. Any unauthenticated user with network access to the database listener can then perform arbitrary administrative operations, giving full impact on data confidentiality, integrity, and availability (read, modify, or destroy data). Only MongoDB Server deployments that hit this specific case-sensitivity condition are affected, and the source data does not specify affected or fixed version ranges. Exploitation has not been reported: there is no public proof of concept, the issue is not in CISA KEV, and EPSS estimates the 30-day exploitation probability at about 0.3% (21st percentile).

Do: Verify on your mongod instances that authorization is actually enforced after every restart (test that unauthenticated connections are rejected, and monitor for anonymous administrative activity). Restrict network access to the database listener with firewalls or private networking so only trusted clients can reach it. Upgrade MongoDB Server to the patched release identified in MongoDB's security advisory once published; the source data does not name fixed version ranges.

CVE-2026-81532 is a buffer overflow (CWE-121) in the MongoDB Connector for BI ODBC driver: cursor names in positioned-cursor SQL statements are not length-checked before the driver copies them into a fixed-length internal buffer while constructing a diagnostic message. An attacker needs only low privileges — any user who can submit SQL through an application that uses this ODBC driver — and triggers the flaw by sending a positioned-cursor statement with an over-long cursor name. The resulting overwrite of adjacent memory can crash the hosting application process and may also allow unintended code to run within it. Only deployments that use the Connector for BI's ODBC driver — typically BI and analytics integrations that issue SQL against MongoDB over ODBC — are affected; the data provided names no other MongoDB products or version ranges. No proof-of-concept is known, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so no active exploitation is known at this time.

Do: Inventory whether any applications or BI-tool integrations connect to MongoDB through the Connector for BI ODBC driver, and upgrade the driver to a patched release once MongoDB publishes fixed versions (no version numbers are available in the data at hand). In the meantime, restrict SQL submission to trusted low-privilege users and cap or validate cursor-name lengths in application code, and alert on crashes of processes hosting the driver.