CVE-2026-59509: cve-search Information Disclosure Flaw

CVE-2026-59509 Overview

CVE-2026-59509 is an unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint of cve-search. The endpoint accepts attacker-controlled parameters that determine the MongoDB collection queried, the fields projected, and the regular-expression filters applied. A remote unauthenticated attacker can pivot these parameters to read arbitrary application MongoDB collections. Successful exploitation exposes administrative usernames and password hashes stored in the mgmt_users collection. The disclosed credential material enables offline password cracking and subsequent administrative account compromise. The weakness is classified under [CWE-20: Improper Input Validation].

Critical Impact
Unauthenticated remote attackers can extract administrator credential hashes from arbitrary MongoDB collections, leading to full administrative compromise after offline cracking.

Affected Products

cve-search (open source vulnerability search project)
Deployments exposing the /fetch_cve_data HTTP endpoint
Instances backed by MongoDB collections including mgmt_users

Discovery Timeline

2026-07-05 - CVE-2026-59509 published to the National Vulnerability Database (NVD)
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-59509

Vulnerability Analysis

The POST /fetch_cve_data endpoint in cve-search accepts request parameters that are passed directly into MongoDB query construction. The parameters control the target collection name, the projection specifying which fields to return, and regular-expression filters applied to documents. The endpoint applies no allowlist on collection names and no validation on projection or filter shape. An attacker submits a crafted request naming the mgmt_users collection, projects the username and password hash fields, and receives the underlying documents in the response.

Because the endpoint requires no authentication, exploitation requires only network reachability to the cve-search web service. The returned password hashes can be cracked offline using standard tooling, after which the attacker authenticates as a legitimate administrator. This transforms an information disclosure primitive into full application compromise.

Root Cause

The root cause is missing input validation on parameters that drive MongoDB query construction. The endpoint trusts client-supplied values for the collection identifier, projection specification, and regex filter without constraining them to expected CVE data collections or field sets.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a single crafted HTTP POST request to /fetch_cve_data, substituting the collection parameter with mgmt_users and projecting the credential fields. Refer to GitHub Issue #1217 and GitHub Pull Request #1218 for the maintainer discussion and fix.

No verified proof-of-concept code has been published. The vulnerability mechanism is described in prose in the referenced GitHub issue.

Detection Methods for CVE-2026-59509

Indicators of Compromise

HTTP POST requests to /fetch_cve_data containing collection parameter values other than expected CVE data collections, such as mgmt_users.
Requests where the projection parameter references credential-related fields like username, password, hash, or salt.
Unusual response sizes from /fetch_cve_data correlating with administrative user counts rather than CVE record counts.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies to /fetch_cve_data and block requests referencing non-CVE collection names.
Enable MongoDB audit logging and alert on find operations against mgmt_users originating from the cve-search application user.
Correlate anomalous /fetch_cve_data request patterns with subsequent administrative login attempts from new source addresses.

Monitoring Recommendations

Log full request bodies for /fetch_cve_data and forward them to a centralized SIEM for retention and query.
Monitor for spikes in 200-response payload sizes on the endpoint that exceed baseline CVE record responses.
Track administrator authentication events immediately following suspicious /fetch_cve_data traffic.

How to Mitigate CVE-2026-59509

Immediate Actions Required

Restrict network access to the cve-search web interface using firewall or reverse-proxy allowlists until patched.
Rotate all administrative credentials stored in the mgmt_users collection and invalidate active sessions.
Review MongoDB query logs for evidence of prior exploitation targeting non-CVE collections.
Apply the upstream fix referenced in GitHub Pull Request #1218 as soon as it is merged into a release.

Patch Information

The maintainers tracked the issue in GitHub Issue #1217 and proposed a fix in GitHub Pull Request #1218. Operators should update to the release containing this pull request. Verify by inspecting the /fetch_cve_data handler for an enforced collection allowlist and constrained projection fields.

Workarounds

Place cve-search behind an authenticating reverse proxy that blocks unauthenticated access to /fetch_cve_data.
Deploy a WAF rule denying POST requests to /fetch_cve_data whose parameters reference mgmt_users or other non-CVE collections.
Run MongoDB under an application role whose read privileges exclude the mgmt_users collection where operationally feasible.

bash

# Example nginx rule blocking suspicious collection parameters
location = /fetch_cve_data {
    if ($request_body ~* "mgmt_users|password|hash") {
        return 403;
    }
    proxy_pass http://cve_search_backend;
}