Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-8053: MongoDB Server allows remote code execution via time-series write

CVE-2026-8053 · published 5 months ago

Summary

If someone with write access to your MongoDB database uses a time‑series collection, they can cause the server to write outside its memory bounds, which could let them run their own code on the server. This affects MongoDB Server versions before 5.0.33, 6.0.28, 7.0.34, 8.0.23, 8.2.9, and 8.3.2. Upgrade to the latest MongoDB release as soon as possible to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
mongodb	mongodb	>= 5.0.0, < 5.0.33 >= 6.0.0, < 6.0.28 >= 7.0.0, < 7.0.34 >= 8.0.0, < 8.0.23 >= 8.2.0, < 8.2.9 >= 8.3.0, < 8.3.2 `cpe:2.3:a:mongodb:mongodb::::::::`

Original advisory text

FlatBSON Duplicate Field Index Drift

An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution.

This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

References

https://jira.mongodb.org/browse/SERVER-126021 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8053.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-8053 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published12 May 2026

Updated4 Nov 2026

First seen13 May 2026

Sources

CVE-2026-8053 · NVD

CVE-2026-8053 · OSV

Track software like this

Free during beta