CVE-2026-25609: 
MongoDB vulnerability analysis and mitigation

CVE-2026-25609 is a missing authorization vulnerability in MongoDB Server that allows authenticated, low-privileged users to bypass read-only restrictions on the filter parameter of the profile command. The flaw stems from incorrect validation of the profile command, causing the server to incorrectly determine that a filter-altering request is read-only. Affected versions include MongoDB 7.0.0–7.0.28, 8.0.0–8.0.17, and 8.2.0–8.2.3. It was published on February 10, 2026, with a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Red Hat Advisory, MongoDB Jira).

The root cause is classified as CWE-862 (Missing Authorization): the MongoDB server's validation logic for the profile command incorrectly classifies requests that modify the filter field as read-only operations, failing to enforce the appropriate write-access check. An authenticated, network-accessible attacker with low privileges can craft a profile command request that alters the filter parameter, bypassing the intended access control enforcement. No special preconditions beyond valid credentials are required, and the attack complexity is low with no user interaction needed (Red Hat Advisory, MongoDB Jira).

Successful exploitation allows authenticated attackers to modify the filter parameter of the MongoDB profiler despite read-only restrictions, potentially enabling unauthorized access to sensitive data captured by the profiler and causing availability disruptions. The confidentiality impact is limited (low), with no direct integrity impact on the database data itself, but the ability to alter profiling filters could expose query patterns, credentials embedded in queries, or other sensitive operational data (Red Hat Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of disclosure (Feedly). The EPSS score is approximately 0.034%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Tenable Nessus plugin 298766 (Tenable).

MongoDB has released patches addressing this vulnerability. Users should upgrade to the following fixed versions based on their deployment branch: MongoDB 7.0.29 or later (for 7.0.x deployments), MongoDB 8.0.18 or later (for 8.0.x deployments), or MongoDB 8.2.4 or later (for 8.2.x deployments). As an interim measure, implement network access controls to restrict authenticated connections to trusted sources only, reducing the attack surface until patching is complete (MongoDB Jira, Red Hat Advisory).