MongoDB security note

CVE-2026-116165 — Check if you run it

Missing Authorization

Fixed in 8.6.101

CVE-2026-55369 — Check if you run it

Waline login accepts a non-string email as a match-all MongoDB query

Fixed in 1.41.0

GHSA-jf75-q64q-g65r — Open the advisory

Waline login accepts a non-string email as a match-all MongoDB query

Affected <= 1.40.3

CVE-2026-106437 — Check if you run it

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum.

Affected < 1.30.13

CVE-2026-106438 — Check if you run it

An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them.

Affected < 1.30.13

CVE-2026-107324 — Check if you run it

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document.

Affected < 1.2.0

CVE-2026-106435 — Check if you run it

MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element

Affected <= 4.18.2

CVE-2026-113870 — Check if you run it

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source.

No version range is stored, so an installed version cannot be checked.