Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-13062

MongoDB Server · Vulnerability

CVSS 4.0 7.1 HIGHCVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-13062

Published

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-13062

Published

MongoDB Server

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "MongoDB",
                    "product": "MongoDB Server",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "7.0",
                            "lessThan": "7.0.39",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "8.0",
                            "lessThan": "8.0.28",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "8.2.0",
                            "lessThan": "8.2.12",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "8.3.0",
                            "lessThan": "8.3.7",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON