Loading vulnerability…
Missing authorization in MongoDB Server aggregation view validation
MongoDB Server versions 9.0.0 through 9.0.6 contain a missing-authorization vulnerability in the aggregation framework. Privilege evaluation during view-definition validation does not cover a nested portion of the supplied aggregation pipeline. An authenticated user with basic database privileges can exploit this omission to construct a view that returns collection contents from a database for which the user lacks read access, potentially exposing stored authentication material.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerability compromises database confidentiality by allowing unauthorized disclosure of collection contents across enforced read-access boundaries. Exposed data may include stored authentication material. Data modification, code execution, and availability impacts are not established.
Patch, then assume compromise.
Upgrade affected MongoDB Server 9.0 installations to version 9.0.7 or a later fixed release.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.