CVE-2026-82069 MEDIUM

CVE-2026-82069: Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router

Vendor Mongodb
Product MongoDB Server
Weakness CWE-212
Published September 8, 2026
Last update September 8, 2026

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface.

Key dates

02Disclosure timeline

September 8, 2026 CVE published
September 8, 2026 Record updated