CVE-2026-13062

Summary

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.

Affected Software

VendorProductVersion RangeStatus
MongoDBMongoDB Server7.0 < 7.0.39affected
MongoDBMongoDB Server8.0 < 8.0.28affected
MongoDBMongoDB Server8.2.0 < 8.2.12affected
MongoDBMongoDB Server8.3.0 < 8.3.7affected

Weaknesses

  • CWE-441: CWE-441: Unintentional Proxy or Intermediary ('Confused Deputy')

References