CVE-2026-18712: MongoDB Server Auth Bypass Vulnerability

CVE-2026-18712 Overview

CVE-2026-18712 is an authorization flaw in MongoDB Server's Queryable Encryption maintenance operations. An authenticated user with privileges on one encrypted collection can modify or destroy data belonging to a different collection. The root cause is insufficient validation of internal metadata references before the server uses them to perform operations on other namespaces. The issue is tracked as MongoDB SERVER-130633 and maps to CWE-863: Incorrect Authorization.

Critical Impact
A low-privileged authenticated user can trigger cross-collection data modification or destruction over the network, bypassing the intended per-collection authorization boundary of Queryable Encryption.

Affected Products

MongoDB Server versions with Queryable Encryption maintenance operations (see MongoDB SERVER-130633 for exact affected releases)
Deployments using Queryable Encryption on multi-collection databases
MongoDB clusters exposing authenticated network access to application users

Discovery Timeline

2026-08-11 - CVE-2026-18712 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18712

Vulnerability Analysis

Queryable Encryption allows MongoDB Server to execute queries against encrypted fields without decrypting them. To support this, the server maintains internal metadata that binds encrypted collections to encryption state collections and index structures. Maintenance operations act on this metadata during rebuilds, compactions, and cleanup.

The vulnerability arises because these maintenance routines resolve internal metadata references without confirming that the caller is authorized on the target namespace. A user who is authorized to run maintenance on one encrypted collection can supply or influence a metadata reference that resolves to a namespace they do not own. The server then performs the maintenance write against the unrelated collection under the caller's session.

The integrity and availability impact is high because maintenance operations can overwrite index state or drop backing data structures. Confidentiality is not directly affected: the flaw modifies or destroys data rather than exposing plaintext.

Root Cause

The defect is a missing authorization check between a supplied or dereferenced metadata reference and the namespace it targets. The maintenance code path trusts the reference as internal and performs the operation without re-evaluating the caller's role against the resolved target collection, which is the pattern described by CWE-863.

Attack Vector

The attacker must authenticate to the MongoDB instance over the network and hold privileges on at least one Queryable Encryption collection. From that position, they invoke a maintenance operation that dereferences metadata pointing at another collection in the same deployment. No user interaction is required. Refer to MongoDB SERVER-130633 for the specific operations and fixed versions.

Detection Methods for CVE-2026-18712

Indicators of Compromise

Maintenance operations on Queryable Encryption collections executed by users whose roles do not grant access to the affected target namespace.
Unexpected schema or index changes on encrypted collections that do not correlate with a scheduled administrative task.
Sudden loss, truncation, or corruption of data in an encrypted collection immediately following activity on a different encrypted collection.

Detection Strategies

Enable MongoDB audit logging and alert on compactStructuredEncryptionData, cleanupStructuredEncryptionData, and related maintenance commands issued by non-administrative principals.
Correlate audit events by session and user, then flag cases where a maintenance command targeting collection A is followed by writes or drops affecting collection B.
Baseline normal maintenance windows and alert on out-of-window executions by application service accounts.

Monitoring Recommendations

Forward MongoDB audit logs and mongod diagnostic logs to a centralized analytics platform for role-based anomaly analysis.
Track counts of maintenance operations per user per collection and alert on deviations from historical norms.
Monitor replica set oplog entries for unexpected drops or metadata rewrites on encrypted namespaces.

How to Mitigate CVE-2026-18712

Immediate Actions Required

Upgrade MongoDB Server to the fixed version identified in MongoDB SERVER-130633.
Inventory all deployments using Queryable Encryption and confirm which application roles hold maintenance privileges.
Revoke Queryable Encryption maintenance privileges from application-tier users and restrict them to dedicated administrative accounts.
Review audit logs for prior invocations of encrypted-collection maintenance commands by non-administrative principals.

Patch Information

MongoDB has tracked the fix under SERVER-130633. Consult the MongoDB Jira issue for the list of patched releases and upgrade guidance for each supported branch. Apply the vendor patch on all replica set members and shards before restoring normal application access.

Workarounds

Restrict Queryable Encryption maintenance operations to a dedicated administrative role and remove those privileges from application users until patching is complete.
Enforce network segmentation so that only trusted administrative hosts can reach the MongoDB wire protocol.
Take verified backups of all encrypted collections prior to running any maintenance operation on a vulnerable server.

bash

# Example: revoke maintenance-capable role from an application user until patched
mongosh "mongodb://admin@dbhost:27017/admin" --eval '
  db.revokeRolesFromUser("app_user", [
    { role: "dbOwner", db: "payments" }
  ]);
  db.grantRolesToUser("app_user", [
    { role: "readWrite", db: "payments" }
  ]);
'