CVE-2026-18705: MongoDB Atlas Vector Search Disclosure Flaw

CVE-2026-18705 Overview

CVE-2026-18705 affects MongoDB Server's Atlas Vector Search feature. An authenticated user with read access to one view can retrieve documents from a different, protected view that sits over the same underlying collection. The flaw stems from insufficient handling of user-supplied fields when the server constructs an internal request forwarded to the search process. The issue is tracked as MongoDB SERVER-129618 and maps to [CWE-807: Reliance on Untrusted Inputs in a Security Decision]. Exploitation requires only low-privilege authentication and produces a confidentiality impact on data that view-level access controls were intended to isolate.

Critical Impact
Authenticated users can bypass view-based access controls in Atlas Vector Search to read documents from views they were not authorized to query, exposing protected records stored in the same underlying collection.

Affected Products

MongoDB Server with Atlas Vector Search enabled
Deployments relying on views to restrict field or document exposure over shared collections
Environments where different roles are granted read access to distinct views of the same collection

Discovery Timeline

2026-08-11 - CVE-2026-18705 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18705

Vulnerability Analysis

MongoDB views are read-only projections over a source collection. Administrators use them to expose subsets of fields or documents to specific roles, keeping the remaining data inaccessible. Atlas Vector Search extends this model by allowing similarity search queries against indexed fields.

In CVE-2026-18705, the server builds an internal request that is forwarded to the search process when handling a vector search query issued against a view. Certain user-supplied fields in the query are trusted without adequate validation. An authenticated caller can influence which view or namespace the search process ultimately targets. The resulting response returns documents from a different view over the same underlying collection, bypassing the access boundary that the queried view was meant to enforce.

The CWE-807 classification reflects that a security decision, specifically the mapping between the caller's authorized view and the data returned, depends on input the caller can manipulate.

Root Cause

The root cause is insufficient server-side validation of client-controlled fields when Atlas Vector Search constructs the internal search request. The trust boundary between the query router and the search process was crossed with attacker-influenced parameters, and the search process honored those parameters instead of enforcing the caller's authorized view scope.

Attack Vector

The attack requires network access to a MongoDB deployment and valid credentials with read access to at least one view backed by a collection that also underlies a protected view. The attacker submits a crafted Atlas Vector Search query against the authorized view, manipulating specific fields to cause the search process to return documents from the protected view. No user interaction or elevated privileges are required.

No public proof-of-concept has been released. Refer to MongoDB Issue SERVER-129618 for vendor-supplied technical detail.

Detection Methods for CVE-2026-18705

Indicators of Compromise

Vector search queries from low-privilege accounts that return documents whose field set does not match the queried view's projection.
Repeated $vectorSearch or $search aggregation stages issued by a single principal against multiple views over the same collection in a short window.
Audit log entries showing successful reads on collections or views that a role has no explicit privilege to query directly.

Detection Strategies

Enable MongoDB auditing for authCheck, getMore, and aggregation command events, then baseline which principals query which views.
Correlate the view named in a query with the fields present in returned documents. Divergence suggests scope escalation.
Alert on aggregation pipelines containing vector search stages issued by roles that were not intended to perform similarity search.

Monitoring Recommendations

Forward MongoDB audit logs and Atlas activity feeds to a centralized SIEM for retention and correlation.
Track per-principal query volume against Atlas Vector Search indexes and flag deviations from historical patterns.
Review role-to-view mappings monthly and reconcile them against actual query telemetry.

How to Mitigate CVE-2026-18705

Immediate Actions Required

Inventory all deployments where Atlas Vector Search indexes are defined on views that share an underlying collection with other views.
Apply the MongoDB Server patch referenced in SERVER-129618 as soon as the fixed version is available for your channel.
Restrict Atlas Vector Search privileges to roles that genuinely require similarity search, removing it from general-purpose read roles.

Patch Information

MongoDB tracks the fix under MongoDB Issue SERVER-129618. Consult the MongoDB security advisories channel for the specific server versions that include the corrected input handling and upgrade Atlas clusters or self-managed nodes accordingly.

Workarounds

Disable Atlas Vector Search indexes on collections that host multiple views with divergent access controls until the patch is applied.
Separate sensitive data into distinct collections rather than relying on view-level projections for access isolation.
Revoke find privileges on affected views for principals that do not have a business need for vector search, reducing the exposed attack surface.

bash

# Example: revoke view read access from a role pending patch deployment
mongosh "mongodb+srv://cluster.example.net/admin" --eval '
  db.revokePrivilegesFromRole(
    "analyst_readonly",
    [ { resource: { db: "prod", collection: "restricted_view" }, actions: [ "find" ] } ]
  )
'