CVE-2026-82069

medium

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query tex…

Vendor / product: Mongodb — mongodb

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface.

CVSS

6.5

6.5 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-09-08 17:18

Modified: 2026-09-16 20:38

NVD status: Analyzed

Last synced 1 day ago

Verified against the source API 2026-10-27 06:51 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

mongodb / mongodb ≥8.3.0 <8.3.9

Weakness classification (CWE)

CWE-212

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://jira.mongodb.org/browse/SERVER-132835

References

https://jira.mongodb.org/browse/SERVER-132835 cna@mongodb.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:51 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-82069

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs