MongoDB Treiber: Mehrere Schwachstellen
WID-SEC-2026-3830 · first 09.10.2026 · updated 28.10.2026 · CVSS 8,8
What it is about
MongoDB ist ein Open-Source-Dokumentendatenbank. Ein Angreifer kann mehrere Schwachstellen in verschiedenen MongoDB Treibern ausnutzen, um einen Denial of Service Angriff durchzuführen und um Daten zu manipulieren.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- einen Denial of Service Angriff durchzuführen
- Daten zu manipulieren
Am I affected?
Affected according to the BSI:
- Debian Linux
- Fedora Linux
- Microsoft Azure Linux azl3
- Open Source MongoDB C Driver
- Open Source MongoDB C++ Driver
- Open Source MongoDB PHP Driver
- Open Source MongoDB Go Driver
- Open Source MongoDB libmongocrypt
- Open Source MongoDB Python Driver
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Install the updates provided by the vendor; details in the sources below.
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- MongoDB Jira Ticket CDRIVER-6370 vom 2026-10-08 jira.mongodb.org
- MongoDB Jira Ticket CDRIVER-6418 vom 2026-10-08 jira.mongodb.org
- MongoDB Jira Ticket CDRIVER-6423 vom 2026-10-08 jira.mongodb.org
- MongoDB Jira Ticket CDRIVER-6419 vom 2026-10-08 jira.mongodb.org
- MongoDB Jira Ticket CXX-3551 vom 2026-10-08 jira.mongodb.org
- MongoDB Jira Ticket CXX-3552 vom 2026-10-08 jira.mongodb.org
- MongoDB Jira Ticket MONGOCRYPT-986 vom 2026-10-08 jira.mongodb.org
- MongoDB Jira Ticket MONGOCRYPT-964 vom 2026-10-08 jira.mongodb.org
- MongoDB Jira Ticket MONGOCRYPT-966 vom 2026-10-08 jira.mongodb.org
- MongoDB Jira Ticket GODRIVER-4102 vom 2026-10-08 jira.mongodb.org
- MongoDB Jira Ticket GODRIVER-4136 vom 2026-10-08 jira.mongodb.org
- MongoDB Jira Ticket PHPC-2741 vom 2026-10-08 jira.mongodb.org
- MongoDB Jira Ticket PHPC-2739 vom 2026-10-08 jira.mongodb.org
- MongoDB Jira Ticket PYTHON-6110 vom 2026-10-08 jira.mongodb.org
- EU Vulnerability Database vom 2026-10-08 euvd.enisa.europa.eu
- EU Vulnerability Database vom 2026-10-08 euvd.enisa.europa.eu
- EU Vulnerability Database vom 2026-10-08 euvd.enisa.europa.eu
- EU Vulnerability Database vom 2026-10-08 euvd.enisa.europa.eu
- EU Vulnerability Database vom 2026-10-08 euvd.enisa.europa.eu
- EU Vulnerability Database vom 2026-10-08 euvd.enisa.europa.eu
- EU Vulnerability Database vom 2026-10-08 euvd.enisa.europa.eu
- EU Vulnerability Database vom 2026-10-08 euvd.enisa.europa.eu
- EU Vulnerability Database vom 2026-10-08 euvd.enisa.europa.eu
- EU Vulnerability Database vom 2026-10-08 euvd.enisa.europa.eu
- EU Vulnerability Database vom 2026-10-08 euvd.enisa.europa.eu
and 11 more sources in the original advisory
CVE: CVE-2026-106428, CVE-2026-106429, CVE-2026-106430, CVE-2026-106433, CVE-2026-106434, CVE-2026-106436, CVE-2026-107324, CVE-2026-107325, CVE-2026-106431, CVE-2026-106432, CVE-2026-106435, CVE-2026-106437, CVE-2026-106438
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.