- Top reward
- $8,500
- Top severity paid
- Critical
- Assets in scope
- 30
- Public CVEs
- 60
- Last change
At a glance
What to know before you start testing.
- Pays up to $8,500
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$8,500 |
| High |
|
$3,500 |
| Medium |
|
$500 |
| Low |
|
$100 |
- Safe harbor
-
Full
MongoDB will not initiate a lawsuit or law enforcement investigation against a researcher in response to reporting a vulnerability if the researcher fully complies with this policy.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
30 assets you may test.
Desktop and binaries 2
- Database Tools Critical
- Drivers Critical
Web 1
- voyageai.com Critical
Wildcard domains 1
- *.mongodb.com/* Critical
Products and areas 26
- App Services/Realm Critical No bounty
- Atlas Charts Critical
- Atlas Data Federation Critical
- Atlas IAM Critical
- Atlas Infinite Critical
- Atlas Payments/Billing Critical
- Cluster-To-Cluster sync Critical
- Compass Critical
- Enterprise Edition Products and Tools Critical
- Evergreen Critical
- Jira Projects Critical
- MongoDB Assistant Critical
- MongoDB Atlas Critical
- MongoDB Atlas Agent Engine Critical
- MongoDB Atlas Agent Engine CLI and First Party Libraries Critical
- MongoDB Connectors Critical
- MongoDB IntelliJ Plugin Critical
- MongoDB MCP Server Critical
- MongoDB Owned GitHub Repositories Critical
- MongoDB Partner Integrations Critical
- MongoDB Server Critical
- MongoDB Shell Critical
- MongoDB Toolchain Critical No bounty
- Relational Migrator Critical
- University Platform Critical No bounty
- VS Code Plugin Critical
Rules
What the policy asks of you, and the bug types it won't reward, quoted from MongoDB (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Without explicit and written consent, researchers may not attempt to perform any activity that will cause disruption to accounts that they do not own or already have access to.
-
Submitted reports must be one vulnerability per report, unless multiple vulnerabilities must be demonstrated to prove impact.
-
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
-
Avoid privacy violations, destruction of data, and interruption or degradation of our service.
-
Avoid using automatic scanners when possible as these usually bombard our systems and we are usually not able to provide eligible reports in the past.
-
Always refrain from causing damage or disruption.
-
Attacks on accounts you do not own or have permissions to is strictly prohibited.
Not accepted
-
Subdomain takeovers for out of scope domains
-
Clickjacking on pages with no sensitive actions
-
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
-
Attacks requiring MITM or physical access to a user's device
-
Previously known vulnerable libraries without a working Proof of Concept
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability
-
Missing best practices in SSL/TLS configuration
-
Any activity that could lead to the disruption of our service (DoS)
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Rate limiting or bruteforce issues on non-authentication endpoints
-
Missing best practices in Content Security Policy
-
Missing HttpOnly or Secure flags on cookies
-
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
-
Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
-
Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors)
-
Tabnabbing
-
Open redirect - unless an additional security impact can be demonstrated
-
Issues that require unlikely user interaction
-
Test/Demo credentials that intentionally exposed for specific use-cases
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 17 minutes ago.
-
Raised
Top reward $7,500 to $8,500.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Reward terms
The reward table or payout terms were edited
-
Reward terms
High $3,000 → $3,500, Critical $7,500 → $8,500
-
Reward raised
Maximum $7,500 → $8,500
-
Scope added
Atlas Infinite
-
Scope added
MongoDB Atlas Agent Engine
-
Scope added
MongoDB Atlas Agent Engine CLI and First Party Libraries
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-87110 | An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue. | Medium 6.9 | 9 Oct 2026 |
| CVE-2026-87109 | An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project. | Medium 6.0 | 9 Oct 2026 |
| CVE-2026-87108 | An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details. | Low 2.3 | 9 Oct 2026 |
| CVE-2026-106435 | The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does n | Medium 5.9 | 8 Oct 2026 |
| CVE-2026-106432 | The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration | Low 2.0 | 8 Oct 2026 |
| CVE-2026-106436 | The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database aut | Medium 6.3 | 8 Oct 2026 |
| CVE-2026-106437 | The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memor | Medium 5.9 | 8 Oct 2026 |
| CVE-2026-107325 | Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No conf | High 8.2 | 8 Oct 2026 |
| CVE-2026-107324 | An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limite | High 8.2 | 8 Oct 2026 |
| CVE-2026-106438 | An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeri | Medium 5.1 | 8 Oct 2026 |
| CVE-2026-106433 | Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the applic | High 8.7 | 8 Oct 2026 |
| CVE-2026-93760 | Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced d | High 8.3 | 18 Sep 2026 |
| CVE-2026-93764 | Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remai | High 7.1 | 18 Sep 2026 |
| CVE-2026-93763 | A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the database can then read values that were intended to be protected from that party. This may result in unin | High 7.1 | 18 Sep 2026 |
| CVE-2026-93762 | Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records. | Critical 9.2 | 18 Sep 2026 |
| CVE-2026-93761 | An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive. | High 8.7 | 18 Sep 2026 |
| CVE-2026-93759 | Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field value | High 8.8 | 18 Sep 2026 |
| CVE-2026-93765 | Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field update. This may result in unintended removal of stored records and in the embedding application becomin | High 8.3 | 18 Sep 2026 |
| CVE-2026-93758 | An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This ma | High 8.6 | 18 Sep 2026 |
| CVE-2026-93394 | A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capt | Medium 6.3 | 17 Sep 2026 |
| CVE-2026-93395 | A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the | Medium 6.9 | 17 Sep 2026 |
| CVE-2026-93393 | A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, | Critical 9.2 | 17 Sep 2026 |
| CVE-2026-92756 | Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database. | Medium 6.8 | 17 Sep 2026 |
| CVE-2026-92758 | If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys. | Medium 5.7 | 17 Sep 2026 |
| CVE-2026-92757 | Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption. | Medium 6.8 | 17 Sep 2026 |
| CVE-2026-89099 | A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of p | High 7.7 | 11 Sep 2026 |
| CVE-2026-88033 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or caus | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88032 | A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption confi | High 8.2 | 10 Sep 2026 |
| CVE-2026-88034 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88035 | A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authenticatio | Medium 5.7 | 10 Sep 2026 |
| CVE-2026-88036 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause a | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88031 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be remov | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88029 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or ca | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88028 | Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence a stored relation identifier may cause an affected application to return a document other than t | High 7.1 | 10 Sep 2026 |
| CVE-2026-88027 | Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwr | High 7.1 | 10 Sep 2026 |
| CVE-2026-88026 | Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter. | High 7.1 | 10 Sep 2026 |
| CVE-2026-88030 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or caus | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88024 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or caus | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88025 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88023 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or caus | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88022 | Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument `where` method when the operator is `=` or `eq`, as well as the `find` and `delete` methods that use that code path. An attacker who ca | High 8.4 | 10 Sep 2026 |
| CVE-2026-82076 | An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of service | High 7.1 | 8 Sep 2026 |
| CVE-2026-82075 | An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication, elevate | High 8.7 | 8 Sep 2026 |
| CVE-2026-82068 | A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster. Manual intervention is required to restore serv | High 7.1 | 8 Sep 2026 |
| CVE-2026-82074 | MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database. | High 7.1 | 8 Sep 2026 |
| CVE-2026-82073 | A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an internal command parameter that can be set by external clients, causing a security check to be improper | High 7.1 | 8 Sep 2026 |
| CVE-2026-82071 | Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary c | High 7.2 | 8 Sep 2026 |
| CVE-2026-82070 | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session w | High 7.1 | 8 Sep 2026 |
| CVE-2026-82069 | A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query li | Medium 5.1 | 8 Sep 2026 |
| CVE-2026-82067 | Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and a | Critical 9.2 | 8 Sep 2026 |
| CVE-2026-82060 | In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries with | Low 2.3 | 8 Sep 2026 |
| CVE-2026-82059 | An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key generation code path. In certain build configuratio | Medium 6.0 | 8 Sep 2026 |
| CVE-2026-82066 | A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable through diagnostic query statistics output. | Medium 5.3 | 8 Sep 2026 |
| CVE-2026-82065 | A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the metadata is subsequently read by diagnostic opera | High 7.1 | 8 Sep 2026 |
| CVE-2026-82064 | A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about internal state do not hold for all member configurations, causing the server process to terminate. | High 8.7 | 8 Sep 2026 |
| CVE-2026-82063 | A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently dereferenced during cursor cleanup, leading to a server process crash. | Medium 6.0 | 8 Sep 2026 |
| CVE-2026-82062 | A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writ | High 7.0 | 8 Sep 2026 |
| CVE-2026-82061 | A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required. | High 7.2 | 8 Sep 2026 |
| CVE-2026-82057 | A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently read from the misconfigured collection, the resu | High 7.1 | 8 Sep 2026 |
| CVE-2026-82058 | A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path performs unsafe numeric conversion on the user-controlled field name without proper exception handling, re | High 7.1 | 8 Sep 2026 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
{F1894478}
At MongoDB, our mission is to empower investors to create, transform, and disrupt industries by unleashing the power of software and data. We are a leading modern, general purpose database platform and our open-source model provides transparency to our users. As such we take security seriously and if you believe you have discovered a security vulnerability in one of our products, we encourage you to disclose it to us as quickly as possible. We look forward to working with the security community to find vulnerabilities in order to keep our business and customers safe.
Table of Contents
- Rules of Engagement
- Program Rules
- Disclosure Policy
- Safe Harbor
- Eligibility
- Testing
- Program Scope
- Out of Scope and Non Qualifying Reports
- Do Not Report
Rules of Engagement
This program should be a collaborative effort and we would ask that you allow time for our teams to process reports through to resolution. By participating in this program, you will be agreeing to the HackerOne Code of Conduct, Finder’s T&C, MongoDB’s Privacy Policy and the Program Rules outlined below.
Program Rules
Please provide detailed reports with reproducible steps. Eligibility is discussed further in the following section however, if the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
- Without explicit and written consent, researchers may not attempt to perform any activity that will cause disruption to accounts that they do not own or already have access to.
- Submitted reports must be one vulnerability per report, unless multiple vulnerabilities must be demonstrated to prove impact.
- When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
- This may apply to reports of similar nature i.e. same vulnerability but different proof of concept provided.
- Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
- Social engineering (e.g. phishing, vishing, smishing) is prohibited.
- Avoid privacy violations, destruction of data, and interruption or degradation of our service.
Disclosure Policy
Please follow HackerOne's disclosure guidelines. In addition, public disclosure of your findings via a blog post, social media, or any other type of medium is not allowed.
Safe Harbor
MongoDB will not initiate a lawsuit or law enforcement investigation against a researcher in response to reporting a vulnerability if the researcher fully complies with this policy. Please understand that if your security research involves the networks, systems, information, applications, products, or services of another party (which is not us), that third party may determine whether to pursue legal action.
You are expected, as always, to comply with all applicable laws and regulations.
Eligibility
We will attempt to provide as much information as possible in the sections below in order to increase the chances of researchers submitting eligible reports. Therefore, we request you to go through the scoping section to ensure that reports are eligible for bounty. Only reports affecting assets listed explicitly in the ‘In Scope’ section are eligible for bounty reward.
PLEASE NOTE eligible subdomain takeover reports will be rewarded at a percentage of the severity reward payout.
Testing
Our security team and tooling are constantly monitoring for attacks on our systems, therefore, a lot of traffic may be coming in and out. In order for our team to quickly identify testing by HackerOne researcher and not a malicious attacker, we ask that you provide an identifier in your testing process.
- Suggested header to requests: X-HackerOne-Research: [H1 username]
- This could further help us identify your eligibility for bounty
- Provide your testing IP when applicable in your reports.
- This could further help us identify your eligibility for bounty
- We will only retain your IP for investigative purposes of the submitted report
- When testing Atlas, create Atlas accounts using your HackerOne email [email protected].
- Avoid using automatic scanners when possible as these usually bombard our systems and we are usually not able to provide eligible reports in the past.
- Always refrain from causing damage or disruption. Researchers can provide proof of concept up to this point and can request for MongoDB to provide confirmation for testing or we can confirm the vulnerability on our end first.
P.S. Please do not hesitate to contact us via the HackerOne support channels.
Attacks on accounts you do not own or have permissions to is strictly prohibited.
Program Scope
The scope of this program is MongoDB Owned Domains , MongoDB Free Tier Atlas and a MongoDB Shipped Products with exceptions (please refer to the Out of Scope section). For a list of our scopes please refer below for a detailed list. When submitting a report, if the asset involved is not explicitly called out in scope, it will not be eligible for bounty.
Out of Scope and Non Qualifying Reports
As we continuously mature this program, we identify issues that are not valuable to the overall security of our domains. A rule of thumb is, non-security related or outdated best practices are generally not accepted. The following report types are also not accepted:
- Public Jira Projects - We have multiple Jira Projects that have been intentionally made public. Please only submit jira related reports that involves sensitive information disclosure.
- Subdomain takeovers for out of scope domains
- Clickjacking on pages with no sensitive actions
- Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
- Attacks requiring MITM or physical access to a user's device
- Previously known vulnerable libraries without a working Proof of Concept
- Comma Separated Values (CSV) injection without demonstrating a vulnerability
- Missing best practices in SSL/TLS configuration
- Any activity that could lead to the disruption of our service (DoS)
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
- Rate limiting or bruteforce issues on non-authentication endpoints
- Missing best practices in Content Security Policy
- Missing HttpOnly or Secure flags on cookies
- Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
- Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
- Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors)
- Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis
- Tabnabbing
- Open redirect - unless an additional security impact can be demonstrated
- Issues that require unlikely user interaction
- Test/Demo credentials that intentionally exposed for specific use-cases
- Known false positives:
- Content injection
- Error Message
- SCRAM-SHA1 authentication mechanism's login credentials disclosure
- SPF record configuration on 10gen.com or mongodb.com
- Server version disclosure
- Information Disclosure on /secure/QueryComponent!Default.jspa endpoint
- Accepted Risks:
- CSRF with minimal security implications i.e. CSRF on logout
- CSRF Token Leak
- JavaScript error
- Good practice settings:
- CSP uses unsafe-inline, Missing Certificate Authority, Authorization Rule, Missing HSTS, Missing security headers, No X-Frame Options Header on developer.mongodb.com, Open redirect using Host header.
- No X-Frame Options Header on developer.mongodb.com
- Any reports on our forums page(https://www.mongodb.com/community/forums/*)
- Post authentication OOM or CPU exhaustion that can cause DoS issues.
Please note that no MongoDB employees and contractors may submit vulnerabilities via HackerOne, and are ineligible for bounties. Please report any findings to the Product Security Team.