MongoDB Server Updates Address 18 Vulnerabilities Across Seven Release Branches

MongoDB released security updates addressing 18 vulnerabilities in MongoDB Server, according to South Korea’s KISA/KrCERT advisory. The flaws include use-after-free errors, authorization weaknesses, unrestricted resource allocation, a race condition, unnecessary privileges, certificate-validation errors, and resource-cleanup issues. Canadian Cyber Centre advisory AV26-1151 and Guyana’s National CIRT also warned of affected MongoDB releases, linking to an issue titled “Allow only system users to use readConcern afterOpTime.”

Administrators should review vulnerability-specific applicability and update affected installations to 4.4.32, 5.0.35, 6.0.30, 7.0.48, 8.0.37, 8.3.16, or 9.0.7 in their respective release branches. Earlier versions are listed as affected, although applicability varies by vulnerability. The supplied notices do not provide severity scores, exploitation prerequisites, or evidence of active exploitation; the Canadian and Guyanese notices also omit CVE identifiers and detailed security impact.