CERT-FR flags multiple MongoDB Server flaws
CERT-FR warns of multiple vulnerabilities in MongoDB Core Server allowing RCE, data compromise, DoS and CSRF; patches available across all major branches.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- Not tied to a specific actor, malware or CVE, only to the sectors it covers, so it may be general reporting. Check the source before acting on it. Whether it concerns you is not assessed.
CERT-FR published an advisory describing multiple vulnerabilities affecting MongoDB Core Server across nearly all supported version branches (4.4.x through 9.1.x). The flaws, tracked internally via a series of MongoDB JIRA SERVER tickets, collectively enable an attacker to achieve arbitrary code execution, compromise data confidentiality and integrity, bypass security policies, cause denial of service, and perform cross-site request forgery (CSRF) attacks against MongoDB deployments.
Affected versions span the full range of actively used releases: 4.4.x before 4.4.32, 5.0.x before 5.0.35, 6.0.x before 6.0.30, 7.0.x before 7.0.48, 8.0.x before 8.0.37, 8.3.x before 8.3.16, 9.0.x before 9.0.7, and 9.1.x before 9.1.0-rc1025. No CVE identifiers are given in this advisory; the underlying technical details are tracked via MongoDB's own JIRA bug-tracking system (SERVER-130169 through SERVER-138119), all dated 10 November 2026. The advisory does not indicate active exploitation in the wild.
Defenders running MongoDB Core Server should prioritize upgrading to the fixed versions referenced for each branch. Given the breadth of affected branches and the severity of possible impacts (including RCE), organizations should treat this as a routine but important patch management action, verifying exposure of MongoDB instances, especially those with network-facing interfaces, and applying vendor-supplied fixes per the referenced JIRA bulletins.
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1522
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs