CVE-2026-4147: MongoDB

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.

Affected products

• MongoDB MongoDB: from 7.0.0, before 7.0.31 (fixed in 7.0.31); from 8.0.0, before 8.0.20 (fixed in 8.0.20); from 8.2.0, before 8.2.6 (fixed in 8.2.6); version 8.3.0 only

Published 2026-03-17. Last modified 2026-06-17.