CVE-2026-18697 — Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos
An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially fo…
Published: 2026-08-11 · CVSS: 8.7 · CVSS 4.0
An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7