Alertas de Seguridad de la Información

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19111] Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools …

Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a forged namespace parameter. To remediate this issue, users should upgrade to version 0.8.3.

nvdaltovulnerabilidad CVSS 8.1 NVD

C Medio vulnerabilidad

04/08/2026

[CVE-2026-48121] @langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that …

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from config.configurable are passed into MongoDB find() queries in MongoDBSaver.getTuple() without type enforcement. If an attacker supplies an objec…

check-pointcheckpointmedio CVSS 6.7 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13078] A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine uncond…

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB se…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-57898] In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments usin…

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter and passed it through repository file handling as both a repository key and, during thumbnail retri…

nvdcriticovulnerabilidad CVSS 9.0 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48204] Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gr…

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the default. The control-header constants (GridFsConstants.GRIDFS_OPERATION, GRIDFS_OBJECT_ID, GRIDFS_MET…

nvdcriticovulnerabilidad CVSS 9.8 NVD

B Crítico vulnerabilidad

26/06/2026

[CVE-2026-54350] Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any p…

Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the builder has published a PUBLIC write query, modifies every document of that collection with one HTTP request. enrichContext at packages/server…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-45687] Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8…

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's sendFileMessage DDP method passes the entire attacker-supplied file object into Uploads.updateFileComplete, which merges it directly into a MongoDB $set update via Object.assign. There is no allow-list of writable fields. An attack…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-45688] Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8…

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's CAS login handler forwards the client-supplied options.cas.credentialToken value straight into a MongoDB findOne({_id: ...}) query without any runtime type check. TypeScript's string parameter annotation is erased at runtime, so an…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-45689] Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8…

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated network attacker obtains a valid Rocket.Chat OAuth access token for an arbitrary user by sending a single HTTP POST with MongoDB query operators to /oauth/token. The Rocket.Chat OAuth2 server does not validate that grant param…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-41862] Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialis…

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM. Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

23/06/2026

[CVE-2026-54313] n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with work…

n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content. This vulnerability is f…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-11933] A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when convert…

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process…

nvdaltovulnerabilidad CVSS 8.8 NVD

V Alto vulnerabilidad

10/06/2026

[CVE-2026-41717] Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability.…

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15;…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-9753] The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff con…

The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-9740] A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash th…

A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-9742] When OIDC authentication is enabled in configuration, clients may set specific values in the "mechan…

When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

02/06/2026

[CVE-2026-45685] OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard…

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.1.0 to before version 0.9.0, malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry agent and cause a denial of service. The parser operates on raw attacker-controlled network payloads …

nvdaltovulnerabilidad CVSS 7.5 NVD