CVE-2026-18697 - Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos

Back Back to CVE browser

HIGH

Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos

Published Aug 11, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.44%

Description

An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.

Affected products

Vendor MongoDB Product MongoDB Server Default
unaffected
- Version
  7.0
  Status
  affected
  Constraints
  <7.0.40
- Version
  8.0
  Status
  affected
  Constraints
  <8.0.29
- Version
  8.3.0
  Status
  affected
  Constraints
  <8.3.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MongoDB

MongoDB Server

unaffected

Version	Status	Constraints
7.0	affected	<7.0.40
8.0	affected	<8.0.29
8.3.0	affected	<8.3.8

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-617

References (1)

https://jira.mongodb.org/browse/SERVER-130110
Vendor AdvisoryIssue Tracking

Link	Providers	Tags
https://jira.mongodb.org/browse/SERVER-130110		Vendor AdvisoryIssue Tracking

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mongodb

Published Aug 11, 2026

Updated Aug 11, 2026

Reserved Aug 3, 2026

Link CVE-2026-18697

CISA Vulnrichment

Updated Aug 11, 2026

NVD

Status Analyzed

Modified Sep 16, 2026

Link CVE-2026-18697

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-18697