CVE-2026-18702

MediumCVSS 6.4/10Last modified Oct 23, 2026

Description

An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitoring by causing excessive log volume.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-187034.2An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certCVE-2026-187046.5An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations aCVE-2026-187056.5An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documentCVE-2026-187066.6An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-managemenCVE-2026-187074.3An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to termCVE-2026-187086.4An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control CVE-2026-187096.4An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progrCVE-2026-18716.5TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of AuthorizationCVE-2026-187106.5A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, tCVE-2026-187117.1An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reCVE-2026-187128.1An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted CVE-2026-187138.8IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a r
CVE-2026-18702: Medium severity, CVSS 6.4 | Vulnix