CVE-2026-18699
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An authenticated user with read-level privileges can cause the MongoDB server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index, resulting in a denial of service affecting connected clients and in-flight operations.
Risk Assessment
The attack can disrupt server operation, affecting all clients and potentially causing interruptions in applications using MongoDB.
Recommendation
It is recommended to update MongoDB to a patched version and restrict read privileges to reduce the risk of exploitation.
Original NVD description (English source)
An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connected clients and in-flight operations.