Loading story…
MongoDB released fixes for two vulnerabilities affecting the Java Driver and the Laravel MongoDB PHP integration. JAVA-6276 affects Java Driver releases before 5.11.1 and is a native-heap use-after-free condition in reactive encryption, triggered when cancellation races with retrieval of Key Management Service (KMS) credentials.
PHPLARA-260 affects Laravel MongoDB versions before 5.11.0 and involves three-argument query-builder where calls that use = with an array value; the fix enforces literal equality for this condition. Organizations using the affected components should upgrade to Java Driver 5.11.1 or later and Laravel MongoDB 5.11.0 or later, and review MongoDB advisory guidance.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The Guyana National CIRT issued an advisory covering JAVA-6276 and PHPLARA-260, recommending upgrades to MongoDB Java Driver 5.11.1 or later and Laravel MongoDB 5.11.0 or later.
The Canadian Centre for Cyber Security published advisory AV26-911, directing users and administrators to review MongoDB's advisory material and apply available updates for the affected Java Driver and Laravel MongoDB products.
MongoDB reported vulnerabilities affecting Java Driver versions before 5.11.1 and Laravel MongoDB (PHP) versions before 5.11.0. JAVA-6276 is a native-heap use-after-free caused by a cancellation race with KMS credential retrieval in reactive encryption, while PHPLARA-260 affects array-value handling in three-argument query-builder where clauses using '='.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cirt.gy
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MongoDB disclosed multiple vulnerabilities in **MongoDB Server** and the **MongoDB Java Driver**, including one critical issue and at least 16 high-severity flaws that can lead to remote code execution, information disclosure, authentication bypass, data manipulation, and denial of service. National cyber agencies in Italy, Canada, and Guyana published advisories urging organizations to review MongoDB’s security bulletins and update affected deployments. A key server-side issue, **`CVE-2026-18691`** / **`SERVER-130264`**, affects intra-cluster SASL egress connection setup and can allow an attacker with adjacent network access to downgrade authentication to **`PLAIN`**, exposing a cleartext keyfile and potentially enabling authentication as MongoDB’s internal superuser. Advisories say the server flaw affects versions before **`7.0.40`**, **`8.0.29`**, **`8.2.13`**, **`8.3.8`**, and **`9.0.0-rc2`**, while the Java Driver issue **`JAVA-6266`** affects versions **`4.11.0`** through **`5.9.1`** and can expose a proxy password through `ProxySettings.toString`; administrators are advised to upgrade to patched releases immediately.
Aug 14, 2026
MongoDB disclosed **12 vulnerabilities** across its database drivers, cryptography library, and BI Connector, including six rated High severity. The most severe reported issues include `CVE-2026-81525` (CVSS 8.6), in which namespace injection in the PHP driver can enable cross-tenant database retargeting; `CVE-2026-81522`, involving cross-database write redirection in the C++ driver; and `CVE-2026-81521`, involving injection risks in the Go driver. Debian packages for the PHP, Go, C++ and `libmongocrypt` components remain flagged as unpatched on affected releases, although no public exploits were known at publication. The BI Connector fixes address SQL injection in `SHOW CREATE` output (`CVE-2026-77586`), unauthenticated SASL-session exhaustion (`CVE-2026-81520`), and an ODBC cursor-name buffer overflow that could crash an application or potentially enable code execution (`CVE-2026-81532`). MongoDB's August BI Connector release remediates several of these issues, while ODBC Driver version **1.4.10** adds cursor-name bounds checks. Organizations should inventory MongoDB drivers and BI Connector deployments, promptly apply vendor updates, enforce strict validation of untrusted database object names and connection parameters, and impose authentication-session timeouts and resource limits. MongoDB has also announced that the BI Connector will reach end of life after September 2026, with the MongoDB SQL Interface recommended for new projects.
Aug 29, 2026
MongoDB disclosed five vulnerabilities in the **BI Connector ODBC Driver**, including one **critical** flaw and four **high-severity** issues affecting releases earlier than **`1.4.9`**. Reported impacts include **remote code execution**, **information disclosure**, and **denial of service**, prompting guidance from Italy’s ACN/CSIRT to apply the vendor’s security updates. One of the high-severity bugs, **`CVE-2026-19003`**, is a memory corruption issue in the driver’s setup dialog that can write outside an allocated buffer when a data source with an oversized path is opened and the user triggers file or folder selection. MongoDB said the flaw is **not remotely exploitable**, but it can still crash the process and, under some build configurations and conditions, lead to unintended code execution in the context of the logged-in user.
Aug 13, 2026