CVE-2026-130598.6HighCWE-807
Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass
MongoDB · MongoDB Server
Not in CISA KEVVendor fix available
0.4%probability of exploitation in the next 30 days
32nd percentile
050100
Higher than 32% of scored CVEs
8.6HighCVSS 4.0
LowMediumHighCrit.
DescriptionNVD
An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 30 Jul.
- MongoDB patches critical flaw amid 27 new security vulnerabilitiesSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.