CVE-2026-18708: MongoDB Server RCE Vulnerability

CVE-2026-18708 Overview

CVE-2026-18708 is a code injection vulnerability [CWE-94] in MongoDB Server's JavaScript scripting engine. An authenticated user with write privileges can store a specially crafted value that, when processed during an internal maintenance cycle, executes attacker-controlled code inside the query scope of other users. The impact is confined to the scripting engine's execution sandbox, which does not expose database, filesystem, or network resources. Successful exploitation can corrupt query results returned to other users and cause denial of service against their operations on the same database.

Critical Impact
Authenticated users with write privileges can inject JavaScript that runs within other users' query scopes, corrupting results and disrupting concurrent database operations.

Affected Products

MongoDB Server (see MongoDB Issue SERVER-130167 for affected versions)
Deployments exposing the JavaScript scripting engine to write-privileged users
Multi-tenant databases where users share collections and query scopes

Discovery Timeline

2026-08-11 - CVE-2026-18708 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18708

Vulnerability Analysis

The flaw resides in MongoDB Server's server-side JavaScript scripting engine. When an authenticated user with write privileges stores a specially crafted value, MongoDB later processes that value during an internal maintenance cycle. During this processing the crafted payload is interpreted as JavaScript and executed within the query scope belonging to other users on the same database.

Execution occurs inside the scripting engine's sandbox. The sandbox blocks access to database internals, the underlying filesystem, and network resources, which limits the attack to logic executed inside the query scope itself. Within that boundary, injected code can manipulate variables, alter computation, and interfere with query evaluation performed on behalf of legitimate users.

The practical consequences are integrity and availability impacts on other tenants of the database. Query results returned to those users can be silently corrupted, and their operations can be disrupted, producing a targeted denial of service without requiring elevated privileges.

Root Cause

The root cause is improper neutralization of stored values that are later evaluated as code by the JavaScript scripting engine [CWE-94]. The maintenance cycle does not isolate scripting contexts between users, allowing an attacker-controlled value written by one user to influence code executed under another user's scope.

Attack Vector

Exploitation requires network access to MongoDB and authenticated credentials with write privileges. The attacker writes a crafted value to a collection processed during an internal maintenance cycle, then waits for the server to evaluate it in another user's query scope. No user interaction from the victim is required. Technical details are tracked in MongoDB Issue SERVER-130167.

Detection Methods for CVE-2026-18708

Indicators of Compromise

Unexpected JavaScript expressions, $where clauses, or Function/eval-like constructs stored inside document fields written by non-administrative users.
Unexplained corruption or inconsistency in query results reported by multiple users querying the same collection.
Elevated error rates, aborted operations, or timeouts affecting queries executed by users other than the writer of recent documents.

Detection Strategies

Audit MongoDB server logs for write operations from low-privileged accounts that insert or update fields containing JavaScript syntax or unusually large string payloads.
Correlate maintenance-cycle activity in MongoDB logs with subsequent query failures or scope errors from unrelated user sessions.
Review role assignments to identify accounts with broader write privileges than their function requires, and flag write activity from those accounts for inspection.

Monitoring Recommendations

Enable MongoDB auditing for insert, update, and findAndModify operations and ship the logs to a centralized SIEM for retention and correlation.
Monitor the frequency and duration of internal maintenance cycles and alert on abnormal spikes in scripting engine errors.
Track query error patterns per user and alert when a single collection produces cross-user integrity or availability anomalies.

How to Mitigate CVE-2026-18708

Immediate Actions Required

Apply the MongoDB Server security update referenced in MongoDB Issue SERVER-130167 as soon as it is available for your deployment channel.
Review and reduce write privileges on shared collections, applying least privilege to every application and human account.
Disable server-side JavaScript execution where it is not required by the application workload.

Patch Information

Refer to MongoDB Issue SERVER-130167 for the authoritative list of fixed versions and upgrade guidance. Upgrade all replica set members and sharded cluster components to a patched release, and validate the upgrade using MongoDB's rolling upgrade procedure to avoid downtime.

Workarounds

Set security.javascriptEnabled: false in mongod.conf on deployments that do not require server-side JavaScript, then restart the affected nodes.
Restrict write access on multi-tenant databases so that untrusted users cannot persist values into collections processed by maintenance cycles.
Add application-layer validation that rejects stored fields containing JavaScript keywords or executable constructs before they reach MongoDB.

bash

# Configuration example: disable server-side JavaScript in mongod.conf
security:
  javascriptEnabled: false

# Verify the setting after restart
mongosh --eval "db.adminCommand({ getParameter: 1, javascriptEnabled: 1 })"