CVE-2026-82069

Awaiting Analysis Awaiting Analysis - Queue

MongoDB Server Query Statistics Information Disclosure

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: MongoDB, Inc.

Description

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-82069

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-212	The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

Attack-Flow Graph

Executive Summary

This vulnerability in MongoDB Server's query statistics serialization allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check bypasses the data redaction mechanism when processing search queries through the sharded cluster router, exposing sensitive query literals via the query statistics interface.

Impact Analysis

If you use MongoDB with monitoring privileges, attackers with access to your monitoring system could view sensitive query data from other users, potentially exposing confidential information like passwords, personal data, or proprietary queries.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Restrict monitoring privileges to only trusted users and review query statistics access controls. Ensure MongoDB Server is updated to the latest patched version to address the improper conditional check in serialization logic.

Hi! I’m here to help you understand CVE-2026-82069. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70