- Top reward
- $8,500
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $8,500
- for critical bugs, from $125.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 1 day
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$8,500 |
| High |
|
$3,750 |
| Medium |
|
$625 |
| Low |
|
$125 |
- Response
-
Within 1 days
~1 hour First response
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 6 excluded.
Web 1
- https://github.com/mongodb-js/mongodb-mcp-server
Products and areas 10
- Configuration loading from command-line flags, environment variables and config files, including how connection strings and Atlas credentials get in
- Connection-string and credential handling once loaded: storage in memory, reuse across sessions, and anywhere a live connection string or Atlas API key can be read back, logged, or returned to the model
- MongoDB gives this repository an asset of its own. The structured scope MongoDB MCP Server is eligible for bounty with no severity override, and its entire instruction is the URL https://github.com/mongodb-js/mongodb-mcp-server, so the program's single reward row applies in full at $100 for Low up to $7,500 for Critical
- Query, filter and aggregation construction from model-supplied arguments, where an injected operator or pipeline stage reaches the driver with more authority than intended
- Telemetry and logging: what leaves the host, and what is written where another local process can read it
- The Atlas management tool set covering projects, clusters, network access lists and database users, which reaches an Atlas organisation with cluster-management rights
- The database tool set: find, aggregate, count, insert, update, delete, index, schema and the collection and database management tools, together with the arguments each accepts from the model
- The server's transports and session handling, both the stdio mode an agent spawns locally and the HTTP mode it connects to over a network
- Tool definitions and their schema validation, the boundary that decides what an untrusted prompt can ultimately cause the server to execute
- Tool-level authorisation and the guards around it: read-only mode, the disabled-tools list, index checks, and the confirmation gates on destructive operations
Out of scope (6)
- Duplicate reports sharing a root cause with an existing submission
- MongoDB-owned repositories outside github.com/mongodb other than this one, which are in scope for submission but not eligible for bounty
- MongoDB's community forums at mongodb.com/community/forums, which the program asks researchers not to test at all
- Non-technical Jira reports and findings with no demonstrated technical impact
- The Model Context Protocol SDK and the other npm dependencies the server builds on, which belong to their own projects
- The MongoDB server, the drivers and the Atlas service itself, which are separate assets on the same program rather than part of this scope
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards.
-
Report against github.com/mongodb-js/mongodb-mcp-server , the repository the named scope points at; other MongoDB repositories outside github.com/mongodb are in scope for submission but not for bounty
-
Show a technical impact rather than a configuration opinion; non-technical Jira-style reports are not eligible
-
Duplicates sharing a root cause with an existing report are closed without a separate award
-
Do not publicly disclose the finding in a blog post, on social media, or through any other medium
-
Demonstrate the issue against your own deployment and Atlas organisation, not someone else's data
Not accepted
-
Non-technical Jira reports and findings with no demonstrated technical impact
-
Duplicate reports sharing a root cause with an existing submission
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical │ $7,500 │ $8,500 High │ $3,000 │ $3,750 Medium │ $500 │ $625 Low │ $100 │ $125 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Access control 35 % Injection 30 % Info disclosure 20 % Auth bypass 10 % Latest advisories Loading the feed Overview The MongoDB MCP Server is the official way to point an LLM agent at a MongoDB cluster or an Atlas organisation, bundled into MongoDB's own developer tooling and pushed to daily at around 1.1k stars. Every deployment holds a live database connection string and, in the Atlas configuration, API keys with cluster-management rights, so a tool-authorisation bug here is a direct path from prompt-level influence to reading or writing a production database, which is the highest-consequence MCP failure mode there is. It has no CVE or GitHub advisory record yet, which on software this young reflects attention rather than assurance. MongoDB has run its HackerOne program for years and carved this repo out as its own paying scope, on a single reward row of $100 for Low up to $7,500 for Critical. sorona.xyz adds 1.25× on top of whatever MongoDB awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~1 hour First response ~9 days Triage ~25 days Bounty In scope MongoDB gives this repository an asset of its own. The structured scope MongoDB MCP Server is eligible for bounty with no severity override, and its entire instruction is the URL https://github.com/mongodb-js/mongodb-mcp-server , so the program's single reward row applies in full at $100 for Low up to $7,500 for Critical The server's transports and session handling, both the stdio mode an agent spawns locally and the HTTP mode it connects to over a network Configuration loading from command-line flags, environment variables and config files, including how connection strings and Atlas credentials get in Connection-string and credential handling once loaded: storage in memory, reuse across sessions, and anywhere a live connection string or Atlas API key can be read back, logged, or returned to the model The database tool set: find, aggregate, count, insert, update, delete, index, schema and the collection and database management tools, together with the arguments each accepts from the model The Atlas management tool set covering projects, clusters, network access lists and database users, which reaches an Atlas organisation with cluster-management rights Tool-level authorisation and the guards around it: read-only mode, the disabled-tools list, index checks, and the confirmation gates on destructive operations Query, filter and aggregation construction from model-supplied arguments, where an injected operator or pipeline stage reaches the driver with more authority than intended Tool definitions and their schema validation, the boundary that decides what an untrusted prompt can ultimately cause the server to execute Telemetry and logging: what leaves the host, and what is written where another local process can read it Out of scope MongoDB-owned repositories outside github.com/mongodb other than this one, which are in scope for submission but not eligible for bounty The MongoDB server, the drivers and the Atlas service itself, which are separate assets on the same program rather than part of this scope MongoDB's community forums at mongodb.com/community/forums, which the program asks researchers not to test at all The Model Context Protocol SDK and the other npm dependencies the server builds on, which belong to their own projects Non-technical Jira reports and findings with no demonstrated technical impact Duplicate reports sharing a root cause with an existing submission Most-valued findings Tool-authorisation bypass where read-only mode does not actually hold and an agent-driven call reaches a write, a drop, or an administrative operation, the 35% access-control class and the one that carries this asset's top band Injection into query, aggregation, or filter construction from model-supplied arguments, letting an untrusted prompt read or modify collections outside the intended scope Exposure of the connection string, credentials, or Atlas API keys through tool output, error messages, or logs, which hands over the cluster rather than one record Authentication bypass against the server's own configured access controls, including anything reachable before a session is properly established Escalation through the Atlas management tools, where a call the agent was allowed to make ends in cluster-level configuration changes Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Report against github.com/mongodb-js/mongodb-mcp-server , the repository the named scope points at; other MongoDB repositories outside github.com/mongodb are in scope for submission but not for bounty Show a technical impact rather than a configuration opinion; non-technical Jira-style reports are not eligible Duplicates sharing a root cause with an existing report are closed without a separate award Do not publicly disclose the finding in a blog post, on social media, or through any other medium Demonstrate the issue against your own deployment and Atlas organisation, not someone else's data Program stats 278 Reports resolved $359k Bounties paid 67% Response efficiency Disclosure Coordinated through MongoDB on HackerOne, on MongoDB's timing. The policy bars publishing your findings through any medium, so file with MongoDB directly and let sorona.xyz track the outcome rather than route a report that could be read as breaching that term. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability