jira.mongodb.org
https://jira.mongodb.org/browse/SERVER-129618 CVE-2026-18705
HIGH
Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data
Record summary
CVE-2026-18705 has a selected CVSS score of 7.1 (high).
Description
An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
MongoDB ServerBrowse MongoDB / MongoDB ServerDefault status: unaffected | CVE List | 8.3.0 to < 8.3.8 | affected |
| 8.0 to < 8.0.29 | affected | ||
| 7.0 to < 7.0.40 | affected |
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-18705