CVE-2026-18701

MediumCVSS 6.5/10Last modified Oct 23, 2026

Description

An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-843

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-187026.4An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings CVE-2026-187034.2An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certCVE-2026-187046.5An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations aCVE-2026-187056.5An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documentCVE-2026-187066.6An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-managemenCVE-2026-187074.3An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to termCVE-2026-187086.4An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control CVE-2026-187096.4An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progrCVE-2026-18716.5TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of AuthorizationCVE-2026-187106.5A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, tCVE-2026-187117.1An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reCVE-2026-187128.1An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted
CVE-2026-18701: Medium severity, CVSS 6.5 | Vulnix