TI-2026-08538 Aliases CVE-2026-9741 GHSA-jp8p-fq38-v738

Client side encryption fails to encrypt values in a $vectorSearch

LOW 30CWE-319Published 2026-06-09 · Updated 2026-06-10

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00103 0th percentileScored 2026-11-07

Fix Fixed MongoDB Server (MongoDB): 8.3.3, 8.2.10, 8.0.24 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MongoDB	MongoDB Server	8.3.0 to before 8.3.3; 8.2.0 to before 8.2.10; 8.0.0 to before 8.0.24; 7.0.0 to before 7.0.35	8.3.3, 8.2.10, 8.0.24, 7.0.35	Patch available	CNA

MongoDB Server VendorMongoDB Affected 8.3.0 to before 8.3.3; 8.2.0 to before 8.2.10; 8.0.0 to before 8.0.24; 7.0.0 to before 7.0.35 Fixed in 8.3.3, 8.2.10, 8.0.24, 7.0.35 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mongodb:mongodb::::::::	7.0.0 to before 7.0.35; 8.0.0 to before 8.0.24; 8.2.0 to before 8.2.10; 8.3.0 to before 8.3.3	Vulnerable	MongoDB

cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* Versions 7.0.0 to before 7.0.35; 8.0.0 to before 8.0.24; 8.2.0 to before 8.2.10; 8.3.0 to before 8.3.3 Vulnerable ·MongoDB

Remediation

Fix · CNA MongoDB Server (MongoDB) Fixed in 8.3.3, 8.2.10, 8.0.24, 7.0.35

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-06-09
MongoDB Server 7.0.35, 8.0.24 and 2 more versions
9 records Highest priority Priority MEDIUM 1 MEDIUM, 8 LOW
Other records, highest priority first
- TI-2026-08537 Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflowPriority MEDIUM 44
- TI-2026-08550 Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.Priority LOW 31
- TI-2026-08549 GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generationPriority LOW 31
Show all 9 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-9741
2026-10-03 Alias added: GHSA-jp8p-fq38-v738

References

Patch 1

https://jira.mongodb.org/browse/SERVER-123507

TI-2025-13542 Zlib compressed protocol header length confusion may allow memory read KEVCVSS 4.0HIGH 8.7
TI-2013-01669 MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the… CVSS 2.0MEDIUM 6.0
TI-2026-56639 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service CVSS 4.0HIGH 8.7
TI-2026-56628 Reachable assertion in MongoDB Server CVSS 4.0HIGH 8.7
TI-2026-15322 Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos CVSS 4.0HIGH 8.7
TI-2026-08537 Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow CVSS 4.0HIGH 8.7

See all 187 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences