MongoDB: Mehrere Schwachstellen
WID-SEC-2026-3209 · first 07.09.2026 · updated 05.10.2026 · CVSS 5,9
What it is about
MongoDB ist ein Open-Source-Dokumentendatenbank. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um einen Denial of Service zu verursachen, Daten zu manipulieren, Informationen offenzulegen oder beliebige Befehle über die MongoDB-Erweiterung für Visual Studio Code auszuführen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- einen Denial of Service zu verursachen
- Daten zu manipulieren
- Informationen offenzulegen oder beliebige Befehle über die MongoDB-Erweiterung für Visual Studio Code auszuführen
Am I affected?
Affected according to the BSI:
- Debian Linux
- Fedora Linux
- Open Source MongoDB C Driver <1.30.9
- Open Source MongoDB C Driver <2.5.2
- Open Source MongoDB C++ Driver <4.5.2
- Open Source MongoDB libmongocrypt <1.20.2
- Open Source MongoDB PHP Driver <1.21.8
- Open Source MongoDB PHP Driver <2.5.1
- Open Source MongoDB for VS Code <1.17.1
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source MongoDB C Driver 1.30.9
- Open Source MongoDB C Driver 2.5.2
- Open Source MongoDB C++ Driver 4.5.2
- Open Source MongoDB libmongocrypt 1.20.2
- Open Source MongoDB PHP Driver 1.21.8
- Open Source MongoDB PHP Driver 2.5.1
- Open Source MongoDB for VS Code 1.17.1
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- MongoDB Jira Ticket CDRIVER-6405 vom 2026-09-06 jira.mongodb.org
- MongoDB Jira Ticket CDRIVER-6407 vom 2026-09-06 jira.mongodb.org
- MongoDB Jira Ticket CDRIVER-6409 vom 2026-09-06 jira.mongodb.org
- MongoDB Jira Ticket CXX-3548 vom 2026-09-06 jira.mongodb.org
- MongoDB Jira Ticket MONGOCRYPT-960 vom 2026-09-06 jira.mongodb.org
- MongoDB Jira Ticket PHPC-2744 vom 2026-09-06 jira.mongodb.org
- MongoDB Jira Ticket VSCODE-798 vom 2026-09-06 jira.mongodb.org
- Fedora Security Advisory FEDORA-2026-358D3CCDFE vom 2026-09-08 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-EPEL-2026-7D7AC5F0F9 vom 2026-09-08 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-EPEL-2026-99AC8D2816 vom 2026-09-08 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2026-CAF49A7828 vom 2026-09-08 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-EPEL-2026-D6AEFC999F vom 2026-09-08 bodhi.fedoraproject.org
- Debian Security Advisory DSA-6539 vom 2026-10-02 security-tracker.debian.org
CVE: CVE-2026-84962, CVE-2026-84963, CVE-2026-84964, CVE-2026-84965, CVE-2026-84966, CVE-2026-84967, CVE-2026-84968
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.