PT-2026-106840

Name of the Vulnerable Software and Affected Versions LangChain versions prior to 1.3.1 Description In the MongoDBChatMessageHistory component, the system fails to enforce the required string type for untrusted structured session identifiers at runtime. This allows a session identifier to be...

CVE-2026-106100: Authorization Bypass Through User-Controlled Key

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to...

MongoDB Compass Unauthorized Access

The vulnerability of MongoDB Compass’s graphical interface, a database management system for MongoDB, is related to improper code generation practices. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

EUVD-2026-86348

PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding...

mongodb-migrations (0.1.1), rolabesti (>=0.1.0, <=0.5.3) potentially affected by CVE-2026-96749 via pymongo (3.2.1)

pymongo PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - mongodb-migrations 0.1.1 - rolabesti =0.1.0, =0.5.3 Source cves: CVE-2026-96749 Source advisory: OSV:GHSA-V4X9-3549-CRWV...

apartment-browser (0.0.1), arctic (>=1.81.1, <=1.82.2) +29 more potentially affected by CVE-2026-96749 via pymongo (3.11.0)

pymongo PYPI version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - apartment-browser 0.0.1 - arctic =1.81.1, =1.0.0, =0.1.0, =1.1.1, =0.1.0, =0.1.5, =0.1.0a5, =0.4.0, =0.5.7 and more Source cves: CVE-2026-96749...

ansible-mongodb-store (>=0.1.0, <=0.3.0), bson-extra (0.0.4) +6 more potentially affected by CVE-2026-96749 via pymongo (3.12.2)

pymongo PYPI version 3.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - ansible-mongodb-store =0.1.0, =1.0.0, =1.0.0, =1.0.0, =0.15.2, =0.1.1, =0.2.14 - ss-daily-tools 1.0.0 Source cves: CVE-2026-96749 Source advisory...

bolinette (>=0.12.1, <=0.14.0), clean-architecture-mongodb-adapter (0.1.3) +16 more potentially affected by CVE-2026-96749 via pymongo (3.12.1)

pymongo PYPI version 3.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - bolinette =0.12.1, =0.0.3, =1.0.38, =0.0.0, =0.2.22, =0.1.3, =1.0.0, =0.0.7, =0.3.6, =0.1.7, =1.1.1, =1.5.0 - spreg-satosa-sync 1.1.3 and more...

EUVD-2026-86346

PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption...

mongodb-migrations (0.1.1), rolabesti (>=0.1.0, <=0.5.3) potentially affected by CVE-2026-88029 via pymongo (3.2.1)

pymongo PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - mongodb-migrations 0.1.1 - rolabesti =0.1.0, =0.5.3 Source cves: CVE-2026-88029 Source advisory: OSV:GHSA-8FVV-FGR5-F8CH...

ansible-mongodb-store (>=0.1.0, <=0.3.0), bson-extra (0.0.4) +6 more potentially affected by CVE-2026-88029 via pymongo (3.12.2)

pymongo PYPI version 3.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - ansible-mongodb-store =0.1.0, =1.0.0, =1.0.0, =1.0.0, =0.15.2, =0.1.1, =0.2.14 - ss-daily-tools 1.0.0 Source cves: CVE-2026-88029 Source advisory...

EUVD-2026-75665

pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods...

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

GHSA-8FXW-FMJ8-XP7J MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

EUVD-2026-75637

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs...

CVE-2026-103546

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546

The MongoDB Controllers for Kubernetes are vulnerable to improper validation of Ops Manager backup configuration . An attacker with permissions to modify an OpsManager custom resource can trigger unintended administrative changes in Ops Manager. This vulnerability specifically impacts deployments...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...