CVE-2026-30833: Rocket.Chat NoSQL Injection Vulnerability

CVE-2026-30833 Overview

A NoSQL injection vulnerability exists in Rocket.Chat's account service used in the ddp-streamer microservice that allows unauthenticated attackers to manipulate MongoDB queries during authentication. This vulnerability is classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) and affects the username-based login flow where user-supplied input is directly embedded into a MongoDB query selector without validation.

Rocket.Chat is an open-source, secure, fully customizable communications platform widely used by organizations for team collaboration. The vulnerability allows an attacker to inject MongoDB operator expressions (e.g., { $regex: '.*' }) in place of a username string, causing the database query to match unintended user records.

Critical Impact

Unauthenticated attackers can manipulate authentication queries to potentially bypass login controls and match unintended user accounts through MongoDB operator injection.

Affected Products

• Rocket.Chat versions prior to 7.10.8
• Rocket.Chat versions prior to 7.11.5, 7.12.5, 7.13.4
• Rocket.Chat versions prior to 8.0.2, 8.1.1, and 8.2.0

Discovery Timeline

• March 6, 2026 - CVE-2026-30833 published to NVD
• March 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-30833

Vulnerability Analysis

This NoSQL injection vulnerability resides in Rocket.Chat's authentication service, specifically within the ddp-streamer microservice. The flaw occurs because user-supplied input during the username-based login flow is directly embedded into MongoDB query selectors without proper validation or sanitization.

When a user attempts to authenticate, the application constructs a MongoDB query using the provided username. However, because the input is not validated, an attacker can supply a malicious payload containing MongoDB query operators instead of a legitimate username string. The database then interprets these operators, potentially matching user records that were not intended to be accessed.

This type of attack is particularly dangerous in authentication contexts because it can allow attackers to bypass normal login procedures or target specific user accounts without knowing the actual username.

Root Cause

The root cause of this vulnerability is improper input validation in the username-based login flow. The account service accepts user-supplied data and directly incorporates it into MongoDB query construction without sanitizing or validating that the input is a simple string value. This allows MongoDB operator objects to be injected, changing the semantics of the query from an exact match to a pattern match or other unintended query behavior.

Attack Vector

The vulnerability is exploitable remotely over the network without authentication. An attacker can craft malicious authentication requests containing MongoDB query operators in place of a username. For example, instead of providing a legitimate username string, an attacker could inject an object like { $regex: '.*' } which would match all usernames in the database, or { $ne: null } to match any non-null username.

The attack targets the DDP (Distributed Data Protocol) streamer microservice, which handles real-time communication in Rocket.Chat. Since this is a network-accessible service and no prior authentication is required to attempt login, the attack surface is significant for any publicly exposed Rocket.Chat instance.

The vulnerability allows attackers to manipulate the query logic to match unintended user records, which could lead to authentication bypass or information disclosure depending on the specific implementation and error handling of the affected systems.

Detection Methods for CVE-2026-30833

Indicators of Compromise

• Unusual login attempts containing JSON objects or MongoDB operators ($regex, $ne, $gt, $in) in username fields
• Authentication logs showing repeated failed logins followed by successful access from the same source
• MongoDB query logs containing operator expressions in user lookup queries
• Unexpected traffic patterns to the ddp-streamer microservice endpoint

Detection Strategies

• Monitor authentication logs for login attempts with malformed or suspicious username values containing special characters like $, {, or }
• Implement web application firewall (WAF) rules to detect and block NoSQL injection patterns in authentication requests
• Review MongoDB slow query logs for unusual query patterns in the accounts collection
• Deploy runtime application self-protection (RASP) solutions to detect query manipulation at the application layer

Monitoring Recommendations

• Enable detailed logging on the Rocket.Chat authentication service and ddp-streamer microservice
• Configure alerting for failed authentication spikes that may indicate injection attempts
• Monitor network traffic to Rocket.Chat instances for malformed DDP protocol messages
• Implement anomaly detection for MongoDB query patterns that deviate from expected authentication behavior

How to Mitigate CVE-2026-30833

Immediate Actions Required

• Upgrade Rocket.Chat to a patched version immediately: 7.10.8, 7.11.5, 7.12.5, 7.13.4, 8.0.2, 8.1.1, or 8.2.0
• Review authentication logs for any signs of exploitation attempts prior to patching
• Consider temporarily restricting network access to Rocket.Chat instances until patching is complete
• Implement additional authentication controls such as IP allowlisting for administrative access

Patch Information

Rocket.Chat has released security patches addressing this NoSQL injection vulnerability. Organizations should upgrade to one of the following patched versions based on their current deployment:

For complete details, refer to the GitHub Security Advisory.

Workarounds

• Deploy a reverse proxy or WAF in front of Rocket.Chat to filter requests containing MongoDB operator patterns in authentication fields
• Restrict network access to the Rocket.Chat instance to trusted IP ranges only
• Disable external access to the ddp-streamer microservice if not required for external users
• Implement additional authentication layers such as SSO or MFA to reduce the impact of potential authentication bypass

# Example: Block NoSQL injection patterns at the reverse proxy level (nginx)
# Add to your nginx server block configuration
location /sockjs/ {
    # Block requests containing MongoDB operators in request body
    if ($request_body ~* "\$regex|\$ne|\$gt|\$lt|\$in|\$nin|\$or|\$and") {
        return 403;
    }
    proxy_pass http://rocketchat_backend;
}