CVE-2026-25609 Overview
CVE-2026-25609 affects MongoDB and stems from incorrect validation of the profile command. The server may incorrectly classify a request that alters the filter parameter as a read-only operation. This misclassification allows an authenticated user with limited privileges to modify profiling filter state through what should be a read-only code path. The vulnerability is categorized under [CWE-862] Missing Authorization. It is tracked in the MongoDB issue tracker as SERVER-112952.
Critical Impact
An authenticated low-privilege user can alter the MongoDB profiler filter configuration through a request that the server treats as read-only, bypassing the authorization checks expected for write or administrative actions.
Affected Products
- MongoDB Server (see vendor advisory SERVER-112952 for affected version ranges)
- Deployments where database profiling is enabled
- Environments allowing authenticated users to issue the profile command
Discovery Timeline
- 2026-02-10 - CVE-2026-25609 published to the National Vulnerability Database
- 2026-02-25 - Last updated in NVD database
Technical Details for CVE-2026-25609
Vulnerability Analysis
MongoDB exposes a profile command that controls the database profiler. The command supports both read-only inspection and configuration changes, including the filter parameter that determines which operations the profiler captures. The server uses request classification to apply authorization and routing rules, including treating read-only commands differently from state-changing ones.
The defect lies in how the server validates incoming profile commands. When a request includes a filter modification, the validation logic still classifies the request as read-only. As a result, authorization checks intended for write operations are not applied. An authenticated user with read-level privileges can therefore change the profiler filter even though changing it is a configuration action.
Because the profiler controls which operations are captured into the system.profile collection, altering its filter affects diagnostic visibility for other users of the database.
Root Cause
The root cause is missing authorization tied to incorrect command classification. The validation routine for the profile command does not inspect whether the request mutates state. The defect maps to [CWE-862] Missing Authorization. The vendor tracks the fix in SERVER-112952.
Attack Vector
Exploitation requires network access to the MongoDB instance and valid authenticated credentials with low privileges. No user interaction is needed. The attacker issues a profile command with a filter argument, and the server applies the change without enforcing the authorization required for configuration mutations. See the MongoDB Issue Tracker Entry for technical context.
Detection Methods for CVE-2026-25609
Indicators of Compromise
- Unexpected entries in the MongoDB audit log showing successful profile commands issued by users without administrative roles.
- Changes to the database profiler filter value that do not correspond to authorized administrative activity.
- Gaps or anomalies in the system.profile collection that suggest profiling scope was narrowed by an unauthorized actor.
Detection Strategies
- Enable MongoDB auditing and filter for the profile command, correlating the calling user's roles against the action performed.
- Compare the current db.getProfilingStatus() output against a known-good baseline on a scheduled cadence.
- Alert when low-privilege accounts issue commands that include a filter field within a profile request body.
Monitoring Recommendations
- Forward MongoDB audit logs to a centralized log platform and retain them for review of profiler configuration changes.
- Track per-database changes to profiling level and filter as configuration drift events.
- Review authentication logs for low-privilege accounts performing administrative-style operations against MongoDB.
How to Mitigate CVE-2026-25609
Immediate Actions Required
- Apply the MongoDB update referenced in SERVER-112952 once available for the deployed release train.
- Audit MongoDB role assignments and remove unnecessary authenticated access to production databases.
- Disable profiling on databases where it is not actively required by setting the profiling level to 0.
Patch Information
MongoDB tracks remediation through the issue SERVER-112952. Administrators should consult the vendor advisory for the fixed version corresponding to their release branch and upgrade affected nodes in a rolling fashion.
Workarounds
- Restrict the profile command to administrative roles using MongoDB's role-based access control until patched binaries are deployed.
- Place MongoDB instances behind network controls that limit access to trusted application hosts and operators.
- Monitor for and revert unauthorized changes to the profiler filter by periodically reasserting the intended profiling configuration.
# Disable profiling and verify status on each database until patched
mongosh --eval 'db.getSiblingDB("<dbname>").setProfilingLevel(0)'
mongosh --eval 'db.getSiblingDB("<dbname>").getProfilingStatus()'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
