MongoDB Libraries Hit by 14 Flaws Risking Data Theft and Loss

Security researchers have disclosed 14 vulnerabilities across MongoDB’s Mongoid, C Driver and Entity Framework Core Provider libraries. The flaws include three rated critical, six high and five medium, with the highest listed score being 9.8 for CVE-2026-93762. No exploitation in the wild or public proof-of-concept code has been confirmed. The reported impact ranges from data deletion and unauthorised disclosure to denial of service, memory corruption and inadvertent plaintext storage of encrypted fields.

Mongoid versions 7.2.0 to 9.1.0 are affected by issues including server-side JavaScript injection, unsafe method dispatch, cross-principal document access and inefficient regular-expression matching. CVE-2026-93762 can allow deletion or disclosure through field-name method injection, while CVE-2026-93759 and CVE-2026-93760 concern JavaScript-executing query criteria and operators.

The C Driver versions 1.24.0 to 2.4.0 include a Windows TLS heap overflow, an out-of-bounds read and a SCRAM authentication weakness that could enable offline password cracking; the article says standard TLS deployments mitigate the authentication issue. Entity Framework Core Provider versions 8.0.0 to 10.0.0 can mishandle encryption settings, potentially causing protected fields to be saved in plaintext. Debug logging may also expose passwords and AWS access keys.

The report advises organisations to update to the latest vendor-secured releases and consult MongoDB’s security alerts for exact version guidance. Mongoid users are told to upgrade beyond 9.1.0, while Windows deployments should prioritise C Driver updates. Teams should also review connection strings and encryption configuration, remove database names where required to prevent plaintext storage, and disable DEBUG logging in production.