CVE-2026-18697: Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos
Published Aug 11, 2026
·Updated
An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.
Affected Software
1 affected component
MongoDB MongoDB Server mongos
Event History
Aug 11, 2026
CVE Published
via MITRE·06:39 PM
Data Sourced
via MITRE·06:39 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-18697?
CVE-2026-18697 has a severity rating of 7.5, classified as high.
2
How do I mitigate CVE-2026-18697?
To mitigate CVE-2026-18697, upgrade to the latest version of MongoDB Server where this vulnerability is addressed.
3
What type of vulnerability is CVE-2026-18697?
CVE-2026-18697 is categorized as an improper input validation vulnerability.
4
What impact does CVE-2026-18697 have on performance?
CVE-2026-18697 can lead to a denial of service by causing the mongos process to terminate unexpectedly.
5
Can CVE-2026-18697 be exploited by authenticated users?
No, CVE-2026-18697 can be exploited by unauthenticated users.