- Top reward
- $7,500
- Top severity paid
- Not published
- Assets in scope
- 10
- Public CVEs
- 112
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $7,500
- top reward.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
Sorona does not publish a reward table for this program.
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
10 assets you may test, 7 excluded.
Web 1
- https://www.mongodb.com
Products and areas 9
- Atlas identity and access management at account.mongodb.com, organizations, projects, and permission-boundary bugs (up to Critical), together with Atlas Charts (charts.mongodb.com) and Atlas Payments/Billing
- Client tooling: Compass (the GUI), the mongosh shell, the mongosync cluster-to-cluster sync utility, and the downloadable Database Tools (all up to Critical)
- Connectors and IDE plugins: the Kafka, PowerBI, BI, Spark, and Tableau connectors, the VS Code plugin (mongodb.mongodb-vscode), the JetBrains IntelliJ plugin, and Relational Migrator (up to Critical)
- MongoDB Atlas, the multi-cloud database platform (up to Critical), its Clusters, Streams, Online Archive, Backup, and Data Federation surfaces, all testable on a Free Tier Atlas account
- MongoDB-owned web properties under *.mongodb.com (up to Critical), and the production Evergreen CI system at github.com/evergreen-ci/evergreen excluding its staging endpoints
- Public Jira projects, but only for information-disclosure findings, technical bugs filed there are not accepted
- The MongoDB Community and Enterprise servers (mongod) and their query, storage, and replication engines, plus Cloud Manager, Ops Manager, Search, and the Kubernetes Operators (up to Critical)
- The MongoDB MCP Server (github.com/mongodb-js/mongodb-mcp-server) and the MongoDB Assistant AI, which is embedded in Data Explorer and Compass (up to Critical)
- The official drivers rated up to Critical, Atlas SQL JDBC and ODBC, C, C++, Go, the JVM family (Java/Scala/Kotlin), Libmongocrypt, Node.js/TypeScript, PHP, Python, Ruby, and Rust (the Swift driver is not in scope)
Out of scope (7)
- Assets that are in scope but not bounty-eligible: App Services/Realm (deprecated), the MongoDB Toolchain, learn.mongodb.com (University, third-party owned), and MongoDB repos outside github.com/mongodb
- Best-practice and configuration findings, missing HSTS/CSP, cookie flags, SPF/DKIM/DMARC email issues, banner/version disclosure, and verbose error messages
- Denial-of-service and service-disruption activity, and rate-limiting reports on non-authentication endpoints
- Explicitly out-of-scope targets: voyageai.com, feedback.mongodb.com (route to AHA), the Artifactory instance being deprecated, all Evergreen staging endpoints, and the Swift driver
- Low-impact web noise: clickjacking on pages with no sensitive action, CSRF on unauthenticated or non-sensitive forms, logout CSRF, open redirects with no added impact, tabnabbing, and content spoofing without HTML/CSS injection
- MITM- or physical-access-dependent attacks, subdomain takeovers on out-of-scope domains, and known vulnerable libraries submitted without a working PoC
- MongoDB's published known false positives, including SCRAM-SHA1 credential disclosure, server version disclosure, missing X-Frame-Options on developer.mongodb.com, and the Host-header open redirect
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz first.
-
Test only against your own instances; never touch production data or other users' systems
-
Submit one clearly written report per issue with steps to reproduce and a proof of concept
-
Do not run automated scanners or high-volume traffic that degrades service availability
-
Stop at proof of concept: do not exfiltrate data, pivot, or persist access once impact is shown
-
Report promptly and give the MongoDB security team reasonable time to triage and remediate
Not accepted
-
Denial-of-service and service-disruption activity, and rate-limiting reports on non-authentication endpoints
-
MITM- or physical-access-dependent attacks, subdomain takeovers on out-of-scope domains, and known vulnerable libraries submitted without a working PoC
-
clickjacking on pages with no sensitive action
-
CSRF on unauthenticated or non-sensitive forms
-
logout CSRF
-
open redirects with no added impact
-
tabnabbing
-
content spoofing without HTML/CSS injection
-
missing HSTS/CSP, cookie flags, SPF/DKIM/DMARC email issues, banner/version disclosure, and verbose error messages
-
SCRAM-SHA1 credential disclosure
-
server version disclosure
-
missing X-Frame-Options on developer.mongodb.com
-
the Host-header open redirect
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-87108 | An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details. | Low 2.3 | 9 Oct 2026 |
| CVE-2026-87109 | An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project. | Medium 6.0 | 9 Oct 2026 |
| CVE-2026-87110 | An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue. | Medium 6.9 | 9 Oct 2026 |
| CVE-2026-106435 | The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does n | Medium 5.9 | 8 Oct 2026 |
| CVE-2026-106432 | The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration | Low 2.0 | 8 Oct 2026 |
| CVE-2026-106436 | The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database aut | Medium 6.3 | 8 Oct 2026 |
| CVE-2026-106437 | The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memor | Medium 5.9 | 8 Oct 2026 |
| CVE-2026-106438 | An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeri | Medium 5.1 | 8 Oct 2026 |
| CVE-2026-107324 | An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limite | High 8.2 | 8 Oct 2026 |
| CVE-2026-107325 | Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No conf | High 8.2 | 8 Oct 2026 |
| CVE-2026-106433 | Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the applic | High 8.7 | 8 Oct 2026 |
| CVE-2026-93759 | Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field value | High 8.8 | 18 Sep 2026 |
| CVE-2026-93760 | Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced d | High 8.3 | 18 Sep 2026 |
| CVE-2026-93761 | An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query condition on an embedded association may become unresponsive. | High 8.7 | 18 Sep 2026 |
| CVE-2026-93762 | Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records. | Critical 9.2 | 18 Sep 2026 |
| CVE-2026-93763 | A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the database can then read values that were intended to be protected from that party. This may result in unin | High 7.1 | 18 Sep 2026 |
| CVE-2026-93764 | Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remai | High 7.1 | 18 Sep 2026 |
| CVE-2026-93758 | An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This ma | High 8.6 | 18 Sep 2026 |
| CVE-2026-93765 | Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field update. This may result in unintended removal of stored records and in the embedding application becomin | High 8.3 | 18 Sep 2026 |
| CVE-2026-93393 | A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, | Critical 9.2 | 17 Sep 2026 |
| CVE-2026-93394 | A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capt | Medium 6.3 | 17 Sep 2026 |
| CVE-2026-93395 | A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the | Medium 6.9 | 17 Sep 2026 |
| CVE-2026-92756 | Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database. | Medium 6.8 | 17 Sep 2026 |
| CVE-2026-92757 | Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption. | Medium 6.8 | 17 Sep 2026 |
| CVE-2026-92758 | If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys. | Medium 5.7 | 17 Sep 2026 |
| CVE-2026-89099 | A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of p | High 7.7 | 11 Sep 2026 |
| CVE-2026-88032 | A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption confi | High 8.2 | 10 Sep 2026 |
| CVE-2026-88033 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or caus | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88034 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88035 | A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authenticatio | Medium 5.7 | 10 Sep 2026 |
| CVE-2026-88036 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause a | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88031 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be remov | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88024 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or caus | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88025 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88026 | Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter. | High 7.1 | 10 Sep 2026 |
| CVE-2026-88027 | Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwr | High 7.1 | 10 Sep 2026 |
| CVE-2026-88028 | Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence a stored relation identifier may cause an affected application to return a document other than t | High 7.1 | 10 Sep 2026 |
| CVE-2026-88029 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or ca | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88030 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or caus | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-88022 | Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument `where` method when the operator is `=` or `eq`, as well as the `find` and `delete` methods that use that code path. An attacker who ca | High 8.4 | 10 Sep 2026 |
| CVE-2026-88023 | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or caus | Medium 6.1 | 10 Sep 2026 |
| CVE-2026-82075 | An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication, elevate | High 8.7 | 8 Sep 2026 |
| CVE-2026-82076 | An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of service | High 7.1 | 8 Sep 2026 |
| CVE-2026-82067 | Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and a | Critical 9.2 | 8 Sep 2026 |
| CVE-2026-82068 | A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster. Manual intervention is required to restore serv | High 7.1 | 8 Sep 2026 |
| CVE-2026-82069 | A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query li | Medium 5.1 | 8 Sep 2026 |
| CVE-2026-82070 | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session w | High 7.1 | 8 Sep 2026 |
| CVE-2026-82071 | Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary c | High 7.2 | 8 Sep 2026 |
| CVE-2026-82073 | A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an internal command parameter that can be set by external clients, causing a security check to be improper | High 7.1 | 8 Sep 2026 |
| CVE-2026-82074 | MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database. | High 7.1 | 8 Sep 2026 |
| CVE-2026-82059 | An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key generation code path. In certain build configuratio | Medium 6.0 | 8 Sep 2026 |
| CVE-2026-82060 | In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries with | Low 2.3 | 8 Sep 2026 |
| CVE-2026-82061 | A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required. | High 7.2 | 8 Sep 2026 |
| CVE-2026-82062 | A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writ | High 7.0 | 8 Sep 2026 |
| CVE-2026-82063 | A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently dereferenced during cursor cleanup, leading to a server process crash. | Medium 6.0 | 8 Sep 2026 |
| CVE-2026-82064 | A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about internal state do not hold for all member configurations, causing the server process to terminate. | High 8.7 | 8 Sep 2026 |
| CVE-2026-82065 | A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the metadata is subsequently read by diagnostic opera | High 7.1 | 8 Sep 2026 |
| CVE-2026-82066 | A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable through diagnostic query statistics output. | Medium 5.3 | 8 Sep 2026 |
| CVE-2026-82057 | A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently read from the misconfigured collection, the resu | High 7.1 | 8 Sep 2026 |
| CVE-2026-82058 | A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path performs unsafe numeric conversion on the user-controlled field name without proper exception handling, re | High 7.1 | 8 Sep 2026 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Program range (by severity) │ $100 - $7,500 │ $125 - $8,500 Submit a vulnerability CVE history 46 Last 12 months 112 Lifetime Denial of service 45 % Memory safety 28 % Access control 17 % Code execution 10 % Latest advisories Loading the feed Overview Route your report through sorona.xyz to receive 1.25x the rewards offered, plus up to $1,000 more for especially complex or well-chained bugs. MongoDB is the widely deployed document-oriented database whose server core is open source; its security team validates submissions, publishes CVEs, and maintains a mature coordinated-disclosure process, so reports need clear impact and reproduction to earn a reward. In scope MongoDB Atlas, the multi-cloud database platform (up to Critical), its Clusters, Streams, Online Archive, Backup, and Data Federation surfaces, all testable on a Free Tier Atlas account Atlas identity and access management at account.mongodb.com, organizations, projects, and permission-boundary bugs (up to Critical), together with Atlas Charts (charts.mongodb.com) and Atlas Payments/Billing The MongoDB Community and Enterprise servers (mongod) and their query, storage, and replication engines, plus Cloud Manager, Ops Manager, Search, and the Kubernetes Operators (up to Critical) Client tooling: Compass (the GUI), the mongosh shell, the mongosync cluster-to-cluster sync utility, and the downloadable Database Tools (all up to Critical) The official drivers rated up to Critical, Atlas SQL JDBC and ODBC, C, C++, Go, the JVM family (Java/Scala/Kotlin), Libmongocrypt, Node.js/TypeScript, PHP, Python, Ruby, and Rust (the Swift driver is not in scope) The MongoDB MCP Server (github.com/mongodb-js/mongodb-mcp-server) and the MongoDB Assistant AI, which is embedded in Data Explorer and Compass (up to Critical) Connectors and IDE plugins: the Kafka, PowerBI, BI, Spark, and Tableau connectors, the VS Code plugin (mongodb.mongodb-vscode), the JetBrains IntelliJ plugin, and Relational Migrator (up to Critical) MongoDB-owned web properties under *.mongodb.com (up to Critical), and the production Evergreen CI system at github.com/evergreen-ci/evergreen excluding its staging endpoints Public Jira projects, but only for information-disclosure findings, technical bugs filed there are not accepted Out of scope Denial-of-service and service-disruption activity, and rate-limiting reports on non-authentication endpoints Assets that are in scope but not bounty-eligible: App Services/Realm (deprecated), the MongoDB Toolchain, learn.mongodb.com (University, third-party owned), and MongoDB repos outside github.com/mongodb Explicitly out-of-scope targets: voyageai.com, feedback.mongodb.com (route to AHA), the Artifactory instance being deprecated, all Evergreen staging endpoints, and the Swift driver MITM- or physical-access-dependent attacks, subdomain takeovers on out-of-scope domains, and known vulnerable libraries submitted without a working PoC Low-impact web noise: clickjacking on pages with no sensitive action, CSRF on unauthenticated or non-sensitive forms, logout CSRF, open redirects with no added impact, tabnabbing, and content spoofing without HTML/CSS injection Best-practice and configuration findings, missing HSTS/CSP, cookie flags, SPF/DKIM/DMARC email issues, banner/version disclosure, and verbose error messages MongoDB's published known false positives, including SCRAM-SHA1 credential disclosure, server version disclosure, missing X-Frame-Options on developer.mongodb.com, and the Host-header open redirect Most-valued findings Server-side RCE or code injection in Atlas platform services or in mongod (Community or Enterprise Server) Authentication and authorization flaws in Atlas IAM at account.mongodb.com, cross-organization, cross-project, or permission-boundary bypass Broken access control and IDOR that exposes another tenant's cluster data in the multi-tenant Atlas platform Payments and billing-logic manipulation in Atlas, and SSRF or injection that reaches Atlas backend/internal services Memory-safety, deserialization, or injection bugs in the official drivers and in libmongocrypt (client-side field-level encryption) Local privilege, injection, or RCE in the Database Tools, mongosh, Compass, and mongosync, plus flaws in the MongoDB MCP Server and MongoDB Assistant AI surface Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Test only against your own instances; never touch production data or other users' systems Submit one clearly written report per issue with steps to reproduce and a proof of concept Do not run automated scanners or high-volume traffic that degrades service availability Stop at proof of concept: do not exfiltrate data, pivot, or persist access once impact is shown Report promptly and give the MongoDB security team reasonable time to triage and remediate Genuinely novel or well-chained bugs qualify for sorona.xyz's bonus of up to $1,000 on top of the base payout Disclosure Coordinated disclosure applies: keep findings private until MongoDB has validated and shipped a fix, and do not publish details or exploit code in the interim. Validation time scales with the complexity and severity of the issue, so allow the security team room to respond before any public write-up. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability