CVE-2026-18712

7.2 highEPSS 0.2%

High (7.2) in mongodb mongodb. EPSS 0.2% chance of exploitation in the next 30 days.

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.

Severity

CVSS 4.0

7.2 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2026-08-11
Modified: 2026-09-25
Record from: the NVD, synced 2026-10-19

Affected

mongodb:mongodb

References

https://jira.mongodb.org/browse/SERVER-130633

Check your stack JSON