CVE-2026-18708: Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes
An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18708?
The severity of CVE-2026-18708 is rated as medium with a score of 6.4.
How do I fix CVE-2026-18708?
To address CVE-2026-18708, ensure you update to the latest version of MongoDB Server that includes the security patch.
Who is affected by CVE-2026-18708?
CVE-2026-18708 affects authenticated users with write privileges on MongoDB Server.
What is the nature of the exploit in CVE-2026-18708?
CVE-2026-18708 allows an attacker to execute unauthorized code within the query scopes of other users.
What can be a potential impact of CVE-2026-18708?
The impact of CVE-2026-18708 includes unauthorized code execution which can compromise the security of the database.