CVE-2026-18687

Name of the Vulnerable Software and Affected Versions MongoDB Server (affected versions not specified)

Description An issue exists in the handling of a Queryable Encryption maintenance operation where certain request parameters are not properly validated against the encrypted field configuration of the collection. An authenticated user with readWrite privileges can submit a specially crafted request to cause a server crash or trigger excessive internal writes. This can lead to resource exhaustion and the corruption of encrypted index data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.