Loading story…
MongoDB issued a security advisory for SERVER-134063, a MongoDB Server flaw involving the handling (or “shredding”) of collection-validator constants during parsing. Public advisories did not assign a CVE, severity rating, technical impact, exploitation status, or attack prerequisites to the issue.
Affected versions are MongoDB Server releases earlier than 7.0.43, 8.0.32, 8.3.11, 9.0.1, and 9.1.0-rc0. The Canadian Centre for Cyber Security and Guyana National CIRT advise administrators to review MongoDB’s advisory and apply the relevant updates to affected deployments.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-918 regarding the MongoDB Server collection-validator parsing vulnerability and advised users and administrators to review MongoDB guidance and apply relevant updates.
MongoDB published a security advisory for SERVER-134063, “Shred collection validator constants during parsing,” affecting MongoDB Server releases earlier than 7.0.43, 8.0.32, 8.3.11, 9.0.1, and 9.1.0-rc0.
The Guyana National CIRT recommended that MongoDB Server users and administrators review the SERVER-134063 advisory and apply the necessary updates for affected releases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cirt.gy
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MongoDB disclosed multiple vulnerabilities in **MongoDB Server** and the **MongoDB Java Driver**, including one critical issue and at least 16 high-severity flaws that can lead to remote code execution, information disclosure, authentication bypass, data manipulation, and denial of service. National cyber agencies in Italy, Canada, and Guyana published advisories urging organizations to review MongoDB’s security bulletins and update affected deployments. A key server-side issue, **`CVE-2026-18691`** / **`SERVER-130264`**, affects intra-cluster SASL egress connection setup and can allow an attacker with adjacent network access to downgrade authentication to **`PLAIN`**, exposing a cleartext keyfile and potentially enabling authentication as MongoDB’s internal superuser. Advisories say the server flaw affects versions before **`7.0.40`**, **`8.0.29`**, **`8.2.13`**, **`8.3.8`**, and **`9.0.0-rc2`**, while the Java Driver issue **`JAVA-6266`** affects versions **`4.11.0`** through **`5.9.1`** and can expose a proxy password through `ProxySettings.toString`; administrators are advised to upgrade to patched releases immediately.
Aug 14, 2026
MongoDB patched a high-severity information disclosure vulnerability, **CVE-2025-14847** or **MongoBleed**, that allows a remote unauthenticated attacker to read sensitive heap memory from vulnerable servers. The flaw affects `OP_COMPRESSED` messages using `zlib`: by manipulating the BSON `uncompressedSize` field, an attacker can make MongoDB allocate an oversized buffer without validating the claimed length, which can cause the server to return uninitialized memory. Researchers said the leak can expose cleartext passwords, credentials, API keys, and other secrets, and can be amplified when a malformed BSON object omits a null terminator, causing MongoDB to continue parsing memory until a null byte is found and include leaked contents in an error response. The vulnerability has been reported as **actively exploited**, and public proof-of-concept code is available. Affected releases include MongoDB Server 8.2 before 8.2.3, 8.0 before 8.0.17, 7.0 before 7.0.28, 6.0 before 6.0.27, 5.0 before 5.0.32, 4.4 before 4.4.30, and all versions of 4.2, 4.0, and 3.6. Defenders were urged to upgrade immediately, disable `zlib` request compression until patching is complete, restrict Internet exposure of TCP port `27017`, review logs for exploitation attempts, and rotate passwords and cryptographic material that may have been exposed. Researchers also warned that internet-scale exposure could be significant, citing tens of thousands to more than 200,000 internet-accessible MongoDB instances identified by scanning services.
Jul 24, 2026
Security advisories warned of two severe database software vulnerabilities with immediate internet-facing risk. In MongoDB, an unauthenticated network attacker can trigger an information disclosure flaw—described in some reporting as **MongoBleed**—to make a vulnerable server return sensitive data such as credentials, secrets, and personal information. The issue affects MongoDB releases dating back to about 2017 and stems from insufficient validation in the `zlib` implementation, which can leak uninitialized heap memory allocated to MongoDB. Working exploitation methods are known, and defenders were told to watch for large volumes of malformed or compressed requests, decompression or memory-handling errors, and repeated unauthenticated connections. Patches are available in versions `8.2.3`, `8.0.17`, `7.0.28`, `6.0.27`, `5.0.32`, and `4.4.30`, while end-of-life branches remain unpatched. A separate advisory disclosed a **critical Redis vulnerability** affecting `8.2.1` and earlier when Lua scripting is enabled, which is the default configuration. The flaw is a use-after-free condition that can be triggered by a specially crafted Lua script and may allow **remote arbitrary code execution**, giving an attacker full control of the host running Redis. Officials urged immediate upgrades because the vulnerability is publicly known and exploitation could begin within hours, and they advised organizations to inspect any previously exposed Redis environments for signs of compromise. Fixed versions were listed as `6.2.20`, `7.2.11`, `7.4.6`, `8.0.4`, and `8.2.2`, alongside renewed guidance that Redis instances should not be exposed directly to the public internet.
Jun 29, 2026