CVE-2026-13062

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...

PT-2026-63466

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user with write privileges on a collection enabled with Queryable Encryption can modify internal encryption metadata fields that should be controlled by the server. This occu...