{"id":"CVE-2026-18696","summary":"Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections","details":"An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual operation.","aliases":["BIT-mongodb-2026-18696"],"modified":"2026-09-18T08:14:45.321569Z","published":"2026-08-11T18:40:35.414Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18696.json","unresolved_ranges":[{"extracted_events":[{"introduced":"8.3.0"},{"fixed":"8.3.8"},{"introduced":"8.0"},{"fixed":"8.0.29"},{"introduced":"7.0"},{"fixed":"7.0.40"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"mongodb","cwe_ids":["CWE-863"]},"references":[{"type":"WEB","url":"https://jira.mongodb.org/browse/SERVER-130139"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18696.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18696"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mongodb/mongo","events":[{"introduced":"37d84072b5c5b9fd723db5fa133fb202ad2317f1"},{"fixed":"d18b92bf3d150c32f129aba9317efb627d3f5ab1"},{"introduced":"b41cda4fe697dce6fd9b83b3805362ccc02fbeb3"},{"fixed":"1cf71c50824f7acb2805f2cfe7bb8c06c74c33b8"},{"introduced":"b993867dce63dd366cd93e60f3f425ed716f6497"},{"last_affected":"10d50f5046de5c76a9d869823219134b3596905a"},{"introduced":"0f29b043a58fdd251ce0a0b32754b8459613c933"},{"fixed":"d100bf19961251f273e1d0bd8ce66fc60634f53c"},{"introduced":"3a33d18cd99f6855f658572fadf4f17ca699a9fe"},{"last_affected":"e78de88ae7504aee707fd083c579c3f54eab50ab"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*","cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:*:*:-:-:*:*","cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:*:*:-:-:*:*","cpe:2.3:a:mongodb:mongodb:9.1.0:alpha0:*:*:-:-:*:*"],"extracted_events":[{"introduced":"7.0.0"},{"fixed":"7.0.40"},{"introduced":"8.0.0"},{"fixed":"8.0.29"},{"introduced":"8.2.0"},{"last_affected":"8.2.12"},{"introduced":"8.3.0"},{"fixed":"8.3.8"},{"introduced":"9.0.0-alpha0"},{"last_affected":"9.0.0-alpha0"},{"introduced":"9.0.0-alpha1"},{"last_affected":"9.0.0-alpha1"},{"introduced":"9.1.0-alpha0"},{"last_affected":"9.1.0-alpha0"}]}}],"versions":["9.0.0-alpha0","9.0.0-alpha1","9.1.0-alpha0","r9.1.0-alpha0","r7.0.35","r8.0.24","r8.2.12","r8.2.10","r8.3.3","r9.0.0-alpha1","r8.3.0","r9.0.0-alpha0","r8.2.4-alpha1","r8.2.4-alpha0","r7.0.27-rc0","r7.0.27","r8.0.17-alpha0","r8.0.16-rc1","r8.0.16","r7.0.27-alpha0","r7.0.26-rc0","r7.0.26","r8.2.3-alpha0","r8.2.2-rc0","r8.2.2","r8.0.16-rc0","r8.0.14-rc1","r8.0.14","r7.0.24-rc0","r7.0.24","r8.2.1-rc1","r8.2.1","r8.2.1-rc0","r7.0.25-alpha0","r8.0.14-rc0","r8.2.0","r8.0.13-rc2","r8.0.13","r8.0.13-rc1","r8.0.13-rc0","r7.0.23-rc1","r7.0.23","r7.0.23-rc0","r7.0.22-rc0","r7.0.22","r8.0.12-rc0","r8.0.12","r8.0.10-rc0","r8.0.10","r7.0.21-rc0","r7.0.21","r7.0.21-alpha0","r7.0.18","r8.0.6","r7.0.17","r8.0.5-rc2","r8.0.5","r8.0.5-rc1","r8.0.5-rc0","r7.0.16-rc1","r7.0.16-rc0","r7.0.16","r8.0.4-rc0","r8.0.4","r7.0.15","r8.0.3","r8.0.2","r7.0.15-rc1","r7.0.15-rc0","r8.0.1-rc0","r8.0.1","r8.0.0","r7.0.14-rc0","r7.0.14","r7.0.13-rc1","r7.0.13","r7.0.13-rc0","r7.0.12-rc1","r7.0.12","r7.0.12-rc0","r7.0.11-rc2","r7.0.11","r7.0.11-rc1","r7.0.11-rc0","r7.0.10-rc0","r7.0.10","r7.0.9-rc1","r7.0.9","r7.0.9-rc0","r7.0.8-rc0","r7.0.8","r7.0.7-rc2","r7.0.7","r7.0.7-rc1","r7.0.7-rc0","r7.0.6-rc0","r7.0.6","r7.0.5-rc0","r7.0.5","r7.0.4-rc0","r7.0.4","r7.0.3-rc1","r7.0.3","r7.0.3-rc0","r7.0.2-rc2","r7.0.2","r7.0.2-rc1","r7.0.2-rc0","r7.0.1-rc0","r7.0.1","r7.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18696.json","vanir_signatures_modified":"2026-09-18T08:14:45Z","vanir_signatures":[{"target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"createColumnObj"},"deprecated":false,"digest":{"function_hash":"151311517198099843615574626630311038376","length":206},"id":"CVE-2026-18696-0f1551b2","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d100bf19961251f273e1d0bd8ce66fc60634f53c"},{"deprecated":false,"digest":{"line_hashes":["156900521284942560218206054117247210957","205064025712093106867367249063742877379","301321549292341267019205101325662424398","306161705597604163179682186220152271047","172326770822600048598883793513870117940","55833503822410305827887206622746266089","99612969462757880738773778354012887934","185847733145215807689347514685334928059","294526452003649744328155500278651981473","288044556838617512684198046845690197741","99849292271786624005258896428756407841","85927581972707685037802608383601329246","94228899259937430581737586941582976059","292097315852060755924492991927889224296","181906561413605708125094417623806960931","219291998277458053825509958529575093072","158997836575203013660127295694672879528","48291296449846927995442725957477573117","243496276184353157891534911983434114077","281127762620171169788587447875492284152"],"threshold":0.9},"id":"CVE-2026-18696-121d47fe","signature_type":"Line","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/1cf71c50824f7acb2805f2cfe7bb8c06c74c33b8","target":{"file":"src/mongo/db/startup_warnings_mongod.cpp"}},{"deprecated":false,"digest":{"function_hash":"132400328100212516507074097697096491827","length":585},"id":"CVE-2026-18696-1ca9a0e0","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d18b92bf3d150c32f129aba9317efb627d3f5ab1","target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"TEST"}},{"deprecated":false,"digest":{"function_hash":"265782250990235496136109318520040299969","length":632},"id":"CVE-2026-18696-202669e9","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d18b92bf3d150c32f129aba9317efb627d3f5ab1","target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"TEST"}},{"digest":{"line_hashes":["82035306378698863695232796123793363351","242165650462762228414702856471141493180","144401054663905851739048236481077539632","297342298338749883084931280278325328564","333215000475062533026277466371564072200","266356844116957585322171768285205501643","318604890955599016372845087414619357255","171746667589517346730480944881908085030","20494138497127885122591173109364120758","239944675985158666329917948528267544792","181590535566684838210099332321944934429","149641294727567758605211726502263720222","81225779347237238479384347518159038888","120961071146895595187817956960611166055","67150906254542437955463799380493376462","224465224956450434015606546820762524698","205051270425195700196836577249819343822","11763437388734207515669096891662140716","242238865810544253137432530277379477822","252541934630354319638410177064838311306","139503128431998067215596758341749361198","299052289658408614931024352745998710039","50539886274882959306916536425898744635","216852720905524912503527476976975936280","328959690886289217439749875697731375542","217921765086877994069961837094170450004","300237865476420177877900041814697282408","109633116438564867878806173699377924354","75858868208593610230619160771067545241","43362055836106184089550963684878895283","12150923176067342102674309718918139741","307133344817343331157924187841329899664","138880864894699921422675508689757923695","242814109627121362216041224844850986447","219768076523833338746432346511905927539","192938091396090493575309930538295825049","65655041711893197989241185021372783300","197353960715779124993889335106393515413","166423563564112579432967849740825293393","204132613984728320428634857526423129781","211436295213832958099963778193515214236","241443460030375020905837802883395780542","161572309484587975029500588668114329120","249117779804920618640697044596698099534","222221809123425069970290113831532527668","210885875370432494645992582571780370799","213274697117618084373457399360904886051","43590232958114505749007206059707879407","35804664663945878894083928633212466977","196122916209379662895526737454568364782","103157869147916655192235419066752469674","232593136647280155187166734613582202479","37382677099628653440542803640790232118","326678159759008797360186129073697778727","55733392408065457916780942070082902133","274461038943505806030858310888006838490","149078892383898163899470321113745995529","175982528274069600942621386246152644295","212548237107785322518385554275684083875","283409457938160628001841764687061596459","216007041763934957070517460546891610821","230221580159345986283954273959799338106","37019815382860667712451886721885623263","61059734592329505911322007005613345331","46598570638167087692937415282625203921","283885286191202203927032306337947813818","161133894325769224637499752967362394165","305894249542110769478752065579803189099","196115424399964647809466985898907303212","106088041485941808954838017833061907957","21998551944656329410344399188529150966","133649325437474609614507179358120693956","10944936238098998487633046056295128258","105044626066399156235620036363191517697","147738242751633682590246202892391430744","228717460356657276013850344097165497505","252129743752437173436592962899920724177","243731679336562895321813443704674029543","331752348329000735689632336369086194732","335588079217516235933722405496674221325","264463884512777694875145180426999240486","186731453367978295595625689860269366435","97115845279483447626835280203503999533","59159260318931815210099605736095973003","231763495193675196632503380192887229156","9132386221697980702746194830395243369","245462561251263400376680122603885047452","235796502110748626788698124420737441121","141574219064002493231739916830386210467","14962933423233375538743110124816507050","318102346868899130278385842937168644359","186671619607065214103778347003915243704","98731454989109656300994680272892858093","321180628107148300300298715862218139398","199835656848421638489639874634099163783","198751599833254068749312650497883553654","241463348093719803391552410808301832708","317286208986188032080330586434263981452","96581718701691272558541556454895770294","88455316065758208782144865457721135490","238497460687953356441331775429067551112","111974941702971096220042196335144815301","143726323217271134523847987384081444882","141412649014723801911067411082131714659","22792031468045618800657749166315365541","320926295841414572752658790455432495721","51466232690985779830122848407663667842","129586365174013581868969684148261962880","256525253849698873099353496038468685577","281417619488202036501111518062364408250","182762236898285511544116462833665843222","326658813392012251411366012251016036004","75440045451479088995314039043762463515","219242032300245170350722958509465401060","80716773077241587532030443147065330944","295552383073495309965576737288539511559","235324129981213538836698237693269093119","127734673461809008404438758823809108430","14359237847597789016126052082363314140","133240182734285759616830580017354996602","11786694626204167397890644560480331480","172231695211963028576787697267274388589","310482033462281585383760205335527179994","44722623713728809738398445330293905529","76636519663076287580166924660204644213","50663103666277000608321740599999256023","32377884469726693542978728920010053197","31799972443433713157692068610560543658","246491478366620282012374726286553507055","6987421069505085998680335221562421483","166194933558704194038866659010223668722","186103546199839514082899104052686872230","233938034561038574962375815887727637238","87563180328732661748606197809270543303","308271619819570483357995290349514560805","82035306378698863695232796123793363351","242165650462762228414702856471141493180","150989845404519017368706364477163715414","79956257817571383455906494958409428382","122884830645786255919010370833952397620","14940873275444015459884752441312578502","112660977294140222784239989957511256702","26497302183395275182283306502065019939","164664212673124126657570851444602772715","7637996603101659028508570553917336942","228923936092449329018599022195044225263","37120222607600903637947897087047057430","270503886271726569135210904677212172409","171797986202409711102036956171016537712","253426067050620867523763133768717024931","76715020781737832754262552406187901426","278347714895443443713872444809025004446","282348110607743421429749069164657141750","33448846252291977119381719649580749292","246239488078993222681212739572178998817","336022743325726118406238868738009534314","232745212054168229339387593585020552011"],"threshold":0.9},"id":"CVE-2026-18696-203183cd","signature_type":"Line","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d18b92bf3d150c32f129aba9317efb627d3f5ab1","target":{"file":"src/mongo/bson/bson_validate.cpp"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d100bf19961251f273e1d0bd8ce66fc60634f53c","target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"TEST"},"deprecated":false,"digest":{"function_hash":"44643749113183394811628801125099775023","length":478},"id":"CVE-2026-18696-230d59a0"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d100bf19961251f273e1d0bd8ce66fc60634f53c","target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"TEST"},"deprecated":false,"digest":{"function_hash":"56448986171898702299586991754916131647","length":634},"id":"CVE-2026-18696-2f6e53f6"},{"target":{"file":"src/mongo/bson/bson_validate.cpp","function":"_doValidateColumn"},"deprecated":false,"digest":{"function_hash":"156308400565603379998967271351665209369","length":481},"id":"CVE-2026-18696-3f858aa8","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d18b92bf3d150c32f129aba9317efb627d3f5ab1"},{"deprecated":false,"digest":{"line_hashes":["193592950059713353269412950912232375802","13884163038216494173285896997696661771","17779248285596067815159733101639687819","211201462012502232220545830622151134171","173261275953923490606268709575819418054","189270793674390707448992320910736784097","177033174486218015255111720354200409536","141294996217964458183374843046289238613","134856389308146850814043737186700274288","270905333313063229780056256230477999157","115142946852211164029990729764734838047","39913569523959233710781008539501685348","281080647386568916830254069034617080357","114683463548611159606805376324120064432","42129624534025633091500174272833234503","254898730434426291981492027896813630721","101691134038663587491607942480084048559","67453846958088707675556961537355049911","212549797233732723375184368125501289933","244748423843077713311664720618450320362","1491349156572317009755039371557061729","276128551348504526969364250912212240344","100441625358297696963632172651072582944","46535382660776061041932497291828331057","116546147502672052997453310351240410853","109509812030179432653252763646387591149","224801684267752027232149867197528850066","192149914502928224108557882616690105123","314252463847032373130785992925797023138","92662454618619981787899408236896007467","329879467051940502429945266754290777188","261503534704092342837860419253754101837","121801198310964383837270350334351844676","177597785434708311494744317947765219343","312928010494915622697861635493084831826","186374669923249079106098030390613609156","47457490959684704379867521067034133922","123399142392277061713394784885235623321","94492203835113505328590770547800748602","292382196755877194577641029740425193488","58271530286627841043903016266836126587","130457102936411322455692349925075484719","120218192941265334502803891030617469104","247720734330423004997632178322820984094","4939075023016697009361412906245186906","339596382549230893849745182202174911424","15461796319207200950459653562211189487","64470588881012856964143618972482977306","286504612661178077999152617286725045826","330310212165930691909891884076992700285","48001007508796235212967952308999275135","203199447286587872313323399729005933318","487335701444202830674289065226249402","225059234795667380768184045006760955490","41274118651220889030270673621173555976","269122037066079678044457293727103311800","76257730405259402676707049269585194091","264046230611900122281420683235463287216","69533212116605679583718423045668185845","85875739926785718506637795026939230055","295687229100691504494444629320077315577","17224295143420280938174616506178355796","64748780793648384710144268257737187261","75323751303916838001355774654126502935","128498096142497293375432253199275166469","244458250226088152680197059694235710999","314690996235197435410300987667782298574","269122037066079678044457293727103311800","169202530530934864451861004195705120415","218106198106140939591489080019878019574","170921685530752086187931704640142090021","124672386310681916027263700125948719602","35614369625373959384119352800376208266","164027473347420305076581657406515314825","310436240515049859675907511629541626085","242249920773147004788896623684354711680","77536063225648350531551024649379753414","125547296691696181779294940009969498461","183015232106754729318678129794755653596","6023952281002450137985084740449849110","243167343559419229758223320186838208662","303700938199691596199172514215336966068","59695807861797881421585833341999862500"],"threshold":0.9},"id":"CVE-2026-18696-43727bde","signature_type":"Line","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d18b92bf3d150c32f129aba9317efb627d3f5ab1","target":{"file":"src/mongo/bson/bson_validate_test.cpp"}},{"id":"CVE-2026-18696-5015519a","signature_type":"Line","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d100bf19961251f273e1d0bd8ce66fc60634f53c","target":{"file":"src/mongo/db/timeseries/timeseries_options_test.cpp"},"deprecated":false,"digest":{"line_hashes":["176073172528132607391428147248270521269","118330656909137005693219307234256630017","120418698319878129853502744174730507830","108873774650059982720156903461952092287","206033342106040071033851239222419800294","3108592923416198556092490833141274308","88059316713610102710446561284061179654"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"151311517198099843615574626630311038376","length":206},"id":"CVE-2026-18696-52c29452","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d18b92bf3d150c32f129aba9317efb627d3f5ab1","target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"createColumnObj"}},{"deprecated":false,"digest":{"function_hash":"132400328100212516507074097697096491827","length":585},"id":"CVE-2026-18696-53463d95","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d100bf19961251f273e1d0bd8ce66fc60634f53c","target":{"function":"TEST","file":"src/mongo/bson/bson_validate_test.cpp"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/1cf71c50824f7acb2805f2cfe7bb8c06c74c33b8","target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"TEST"},"deprecated":false,"digest":{"function_hash":"338021437319632662316733454493448527081","length":551},"id":"CVE-2026-18696-5d48d1cb"},{"signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/1cf71c50824f7acb2805f2cfe7bb8c06c74c33b8","target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"TEST"},"deprecated":false,"digest":{"function_hash":"195066760987359264212166687145711831038","length":541},"id":"CVE-2026-18696-715ff9bf","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d18b92bf3d150c32f129aba9317efb627d3f5ab1","target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"TEST"},"deprecated":false,"digest":{"length":551,"function_hash":"338021437319632662316733454493448527081"},"id":"CVE-2026-18696-71edc321","signature_type":"Function"},{"digest":{"function_hash":"101186964201375010590797311969722152635","length":891},"id":"CVE-2026-18696-7d4395bc","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/1cf71c50824f7acb2805f2cfe7bb8c06c74c33b8","target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"TEST"},"deprecated":false},{"id":"CVE-2026-18696-8454bce7","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d100bf19961251f273e1d0bd8ce66fc60634f53c","target":{"function":"_doValidateColumn","file":"src/mongo/bson/bson_validate.cpp"},"deprecated":false,"digest":{"function_hash":"156308400565603379998967271351665209369","length":481}},{"source":"https://github.com/mongodb/mongo/commit/d100bf19961251f273e1d0bd8ce66fc60634f53c","target":{"file":"src/mongo/db/timeseries/timeseries_options_test.cpp","function":"TEST"},"deprecated":false,"digest":{"length":76,"function_hash":"249455288903531770703272976296934374066"},"id":"CVE-2026-18696-8565e0f8","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["338058124257255568622612868904316390486","227829626936797975848634446578189711189","105284863809607242493875864834675845875","154389598984111558004264272231905649001","197126353624540957305375104529067128223","125170076911892831479407866524861969100","55833503822410305827887206622746266089","272583256717071792638857350992398792921","319653688042543923302495263620499203680","71746954939949839071335171605533875440","288044556838617512684198046845690197741","99849292271786624005258896428756407841","85927581972707685037802608383601329246","94228899259937430581737586941582976059","292097315852060755924492991927889224296","181906561413605708125094417623806960931","219291998277458053825509958529575093072","158997836575203013660127295694672879528","48291296449846927995442725957477573117","243496276184353157891534911983434114077","281127762620171169788587447875492284152"],"threshold":0.9},"id":"CVE-2026-18696-8a7150ef","signature_type":"Line","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d18b92bf3d150c32f129aba9317efb627d3f5ab1","target":{"file":"src/mongo/db/startup_warnings_mongod.cpp"},"deprecated":false},{"target":{"file":"src/mongo/db/startup_warnings_mongod.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["156900521284942560218206054117247210957","205064025712093106867367249063742877379","301321549292341267019205101325662424398","306161705597604163179682186220152271047","172326770822600048598883793513870117940","55833503822410305827887206622746266089","99612969462757880738773778354012887934","185847733145215807689347514685334928059","294526452003649744328155500278651981473","288044556838617512684198046845690197741","99849292271786624005258896428756407841","85927581972707685037802608383601329246","94228899259937430581737586941582976059","292097315852060755924492991927889224296","181906561413605708125094417623806960931","219291998277458053825509958529575093072","158997836575203013660127295694672879528","48291296449846927995442725957477573117","243496276184353157891534911983434114077","281127762620171169788587447875492284152"]},"id":"CVE-2026-18696-8d28898b","signature_type":"Line","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d100bf19961251f273e1d0bd8ce66fc60634f53c"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/1cf71c50824f7acb2805f2cfe7bb8c06c74c33b8","target":{"function":"TEST","file":"src/mongo/bson/bson_validate_test.cpp"},"deprecated":false,"digest":{"function_hash":"265782250990235496136109318520040299969","length":632},"id":"CVE-2026-18696-8ecda8b6"},{"target":{"function":"logMongodStartupWarnings","file":"src/mongo/db/startup_warnings_mongod.cpp"},"deprecated":false,"digest":{"function_hash":"26272928155213883748518777055890525799","length":2442},"id":"CVE-2026-18696-9a621cfa","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d18b92bf3d150c32f129aba9317efb627d3f5ab1"},{"target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"TEST"},"deprecated":false,"digest":{"function_hash":"132400328100212516507074097697096491827","length":585},"id":"CVE-2026-18696-9db70e10","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/1cf71c50824f7acb2805f2cfe7bb8c06c74c33b8"},{"source":"https://github.com/mongodb/mongo/commit/d18b92bf3d150c32f129aba9317efb627d3f5ab1","target":{"function":"TEST","file":"src/mongo/bson/bson_validate_test.cpp"},"deprecated":false,"digest":{"function_hash":"195066760987359264212166687145711831038","length":541},"id":"CVE-2026-18696-9f6f170c","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-18696-b3dab2b2","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d18b92bf3d150c32f129aba9317efb627d3f5ab1","target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"TEST"},"deprecated":false,"digest":{"function_hash":"101186964201375010590797311969722152635","length":891}},{"deprecated":false,"digest":{"line_hashes":["82035306378698863695232796123793363351","33100772726938519349719007997233579778","259801986787604255210074805193520078229","99435478325954606816576117470728298607","333215000475062533026277466371564072200","266356844116957585322171768285205501643","318604890955599016372845087414619357255","171746667589517346730480944881908085030","252803298284906316915292431477636017398","306255473453019622575873241660035559548","15349657629779148902923588685300840798","149641294727567758605211726502263720222","81225779347237238479384347518159038888","120961071146895595187817956960611166055","67150906254542437955463799380493376462","224465224956450434015606546820762524698","205051270425195700196836577249819343822","11763437388734207515669096891662140716","242238865810544253137432530277379477822","252541934630354319638410177064838311306","139503128431998067215596758341749361198","299052289658408614931024352745998710039","50539886274882959306916536425898744635","216852720905524912503527476976975936280","328959690886289217439749875697731375542","217921765086877994069961837094170450004","300237865476420177877900041814697282408","109633116438564867878806173699377924354","75858868208593610230619160771067545241","43362055836106184089550963684878895283","12150923176067342102674309718918139741","307133344817343331157924187841329899664","138880864894699921422675508689757923695","242814109627121362216041224844850986447","219768076523833338746432346511905927539","192938091396090493575309930538295825049","65655041711893197989241185021372783300","197353960715779124993889335106393515413","166423563564112579432967849740825293393","204132613984728320428634857526423129781","211436295213832958099963778193515214236","241443460030375020905837802883395780542","161572309484587975029500588668114329120","192716364701937833746620691259735401064","199449149991382465795537107355328191330","1391173712097415281845347293583344367","222564474345964931233611262128711400244","43590232958114505749007206059707879407","35804664663945878894083928633212466977","196122916209379662895526737454568364782","103157869147916655192235419066752469674","232593136647280155187166734613582202479","37382677099628653440542803640790232118","22428807488648943339051377311838177127","158714997578249444244614784548146153461","325183081283743575014155939684229058739","35804374578480093667021491210047583457","175982528274069600942621386246152644295","212548237107785322518385554275684083875","283409457938160628001841764687061596459","216007041763934957070517460546891610821","230221580159345986283954273959799338106","37019815382860667712451886721885623263","61059734592329505911322007005613345331","46598570638167087692937415282625203921","283885286191202203927032306337947813818","161133894325769224637499752967362394165","305894249542110769478752065579803189099","231593229436790858133341663033244854717","51734688826066423824403853997687798722","171491975403521614385338970981530669900","115540706124835569505460009387381615846","264463884512777694875145180426999240486","186731453367978295595625689860269366435","97115845279483447626835280203503999533","59159260318931815210099605736095973003","231763495193675196632503380192887229156","9132386221697980702746194830395243369","245462561251263400376680122603885047452","235796502110748626788698124420737441121","141574219064002493231739916830386210467","14962933423233375538743110124816507050","318102346868899130278385842937168644359","186671619607065214103778347003915243704","98731454989109656300994680272892858093","321180628107148300300298715862218139398","199835656848421638489639874634099163783","198751599833254068749312650497883553654","241463348093719803391552410808301832708","317286208986188032080330586434263981452","96581718701691272558541556454895770294","88455316065758208782144865457721135490","238497460687953356441331775429067551112","111974941702971096220042196335144815301","143726323217271134523847987384081444882","141412649014723801911067411082131714659","22792031468045618800657749166315365541","320926295841414572752658790455432495721","265746586691145583422747962285593758768","71782810372944573612352130032222492944","235239127044650799225744181287969089011","281417619488202036501111518062364408250","182762236898285511544116462833665843222","326658813392012251411366012251016036004","75440045451479088995314039043762463515","265621217882143426408418082585949488148","93563410139496753144107621745085701964","295552383073495309965576737288539511559","235324129981213538836698237693269093119","276720334049063297820114123258324823587","104052411905880046743658526389405750712","204067551504215578830969912289447713514","127734673461809008404438758823809108430","14359237847597789016126052082363314140","133240182734285759616830580017354996602","95551755504617259033138844125339083147","98877429264646065580086619327753126160","310482033462281585383760205335527179994","44722623713728809738398445330293905529","76636519663076287580166924660204644213","50663103666277000608321740599999256023","32377884469726693542978728920010053197","298861196801657028270119132748376315673","246491478366620282012374726286553507055","6987421069505085998680335221562421483","166194933558704194038866659010223668722","82035306378698863695232796123793363351","33100772726938519349719007997233579778","31852706500211341862441315565885507324","92704748633115335184105251000332690990","214559750377118884819925338679323064684","14940873275444015459884752441312578502","112660977294140222784239989957511256702","26497302183395275182283306502065019939","164664212673124126657570851444602772715","7637996603101659028508570553917336942","228923936092449329018599022195044225263","37120222607600903637947897087047057430","270503886271726569135210904677212172409","171797986202409711102036956171016537712","253426067050620867523763133768717024931","76715020781737832754262552406187901426","278347714895443443713872444809025004446","77288622536342609772514792645859138816","12763632672095491150412562736317338636","246239488078993222681212739572178998817","336022743325726118406238868738009534314","232745212054168229339387593585020552011"],"threshold":0.9},"id":"CVE-2026-18696-c90af9b0","signature_type":"Line","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d100bf19961251f273e1d0bd8ce66fc60634f53c","target":{"file":"src/mongo/bson/bson_validate.cpp"}},{"target":{"file":"src/mongo/bson/bson_validate.cpp"},"deprecated":false,"digest":{"line_hashes":["82035306378698863695232796123793363351","33100772726938519349719007997233579778","259801986787604255210074805193520078229","99435478325954606816576117470728298607","333215000475062533026277466371564072200","266356844116957585322171768285205501643","318604890955599016372845087414619357255","171746667589517346730480944881908085030","20494138497127885122591173109364120758","239944675985158666329917948528267544792","181590535566684838210099332321944934429","149641294727567758605211726502263720222","81225779347237238479384347518159038888","120961071146895595187817956960611166055","67150906254542437955463799380493376462","224465224956450434015606546820762524698","205051270425195700196836577249819343822","11763437388734207515669096891662140716","242238865810544253137432530277379477822","252541934630354319638410177064838311306","139503128431998067215596758341749361198","299052289658408614931024352745998710039","50539886274882959306916536425898744635","216852720905524912503527476976975936280","328959690886289217439749875697731375542","217921765086877994069961837094170450004","300237865476420177877900041814697282408","109633116438564867878806173699377924354","75858868208593610230619160771067545241","43362055836106184089550963684878895283","12150923176067342102674309718918139741","307133344817343331157924187841329899664","138880864894699921422675508689757923695","242814109627121362216041224844850986447","219768076523833338746432346511905927539","192938091396090493575309930538295825049","65655041711893197989241185021372783300","197353960715779124993889335106393515413","166423563564112579432967849740825293393","204132613984728320428634857526423129781","211436295213832958099963778193515214236","241443460030375020905837802883395780542","161572309484587975029500588668114329120","249117779804920618640697044596698099534","222221809123425069970290113831532527668","210885875370432494645992582571780370799","213274697117618084373457399360904886051","43590232958114505749007206059707879407","35804664663945878894083928633212466977","196122916209379662895526737454568364782","103157869147916655192235419066752469674","232593136647280155187166734613582202479","37382677099628653440542803640790232118","326678159759008797360186129073697778727","55733392408065457916780942070082902133","274461038943505806030858310888006838490","149078892383898163899470321113745995529","175982528274069600942621386246152644295","212548237107785322518385554275684083875","283409457938160628001841764687061596459","216007041763934957070517460546891610821","230221580159345986283954273959799338106","37019815382860667712451886721885623263","61059734592329505911322007005613345331","46598570638167087692937415282625203921","283885286191202203927032306337947813818","161133894325769224637499752967362394165","305894249542110769478752065579803189099","231593229436790858133341663033244854717","51734688826066423824403853997687798722","171491975403521614385338970981530669900","115540706124835569505460009387381615846","264463884512777694875145180426999240486","186731453367978295595625689860269366435","97115845279483447626835280203503999533","59159260318931815210099605736095973003","231763495193675196632503380192887229156","9132386221697980702746194830395243369","245462561251263400376680122603885047452","235796502110748626788698124420737441121","141574219064002493231739916830386210467","14962933423233375538743110124816507050","318102346868899130278385842937168644359","186671619607065214103778347003915243704","98731454989109656300994680272892858093","321180628107148300300298715862218139398","199835656848421638489639874634099163783","198751599833254068749312650497883553654","241463348093719803391552410808301832708","317286208986188032080330586434263981452","96581718701691272558541556454895770294","88455316065758208782144865457721135490","238497460687953356441331775429067551112","111974941702971096220042196335144815301","143726323217271134523847987384081444882","141412649014723801911067411082131714659","22792031468045618800657749166315365541","320926295841414572752658790455432495721","265746586691145583422747962285593758768","71782810372944573612352130032222492944","235239127044650799225744181287969089011","281417619488202036501111518062364408250","182762236898285511544116462833665843222","326658813392012251411366012251016036004","75440045451479088995314039043762463515","219242032300245170350722958509465401060","80716773077241587532030443147065330944","295552383073495309965576737288539511559","235324129981213538836698237693269093119","276720334049063297820114123258324823587","104052411905880046743658526389405750712","204067551504215578830969912289447713514","127734673461809008404438758823809108430","14359237847597789016126052082363314140","133240182734285759616830580017354996602","11786694626204167397890644560480331480","172231695211963028576787697267274388589","310482033462281585383760205335527179994","44722623713728809738398445330293905529","76636519663076287580166924660204644213","50663103666277000608321740599999256023","32377884469726693542978728920010053197","31799972443433713157692068610560543658","246491478366620282012374726286553507055","6987421069505085998680335221562421483","166194933558704194038866659010223668722","82035306378698863695232796123793363351","33100772726938519349719007997233579778","31852706500211341862441315565885507324","92704748633115335184105251000332690990","214559750377118884819925338679323064684","14940873275444015459884752441312578502","112660977294140222784239989957511256702","26497302183395275182283306502065019939","164664212673124126657570851444602772715","7637996603101659028508570553917336942","228923936092449329018599022195044225263","37120222607600903637947897087047057430","270503886271726569135210904677212172409","171797986202409711102036956171016537712","253426067050620867523763133768717024931","76715020781737832754262552406187901426","278347714895443443713872444809025004446","77288622536342609772514792645859138816","12763632672095491150412562736317338636","246239488078993222681212739572178998817","336022743325726118406238868738009534314","232745212054168229339387593585020552011"],"threshold":0.9},"id":"CVE-2026-18696-d0a01c9a","signature_type":"Line","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/1cf71c50824f7acb2805f2cfe7bb8c06c74c33b8"},{"digest":{"function_hash":"71377248726610709641434731341470543804","length":1951},"id":"CVE-2026-18696-d55366d8","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d100bf19961251f273e1d0bd8ce66fc60634f53c","target":{"file":"src/mongo/db/startup_warnings_mongod.cpp","function":"logMongodStartupWarnings"},"deprecated":false},{"source":"https://github.com/mongodb/mongo/commit/d100bf19961251f273e1d0bd8ce66fc60634f53c","target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"TEST"},"deprecated":false,"digest":{"function_hash":"265782250990235496136109318520040299969","length":632},"id":"CVE-2026-18696-de3ca19c","signature_type":"Function","signature_version":"v1"},{"digest":{"length":891,"function_hash":"101186964201375010590797311969722152635"},"id":"CVE-2026-18696-e0adc285","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d100bf19961251f273e1d0bd8ce66fc60634f53c","target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"TEST"},"deprecated":false},{"digest":{"function_hash":"71377248726610709641434731341470543804","length":1951},"id":"CVE-2026-18696-e169bd05","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/1cf71c50824f7acb2805f2cfe7bb8c06c74c33b8","target":{"file":"src/mongo/db/startup_warnings_mongod.cpp","function":"logMongodStartupWarnings"},"deprecated":false},{"id":"CVE-2026-18696-e190bb18","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d100bf19961251f273e1d0bd8ce66fc60634f53c","target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"TEST"},"deprecated":false,"digest":{"function_hash":"338021437319632662316733454493448527081","length":551}},{"deprecated":false,"digest":{"function_hash":"156308400565603379998967271351665209369","length":481},"id":"CVE-2026-18696-eaa2b8a6","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/1cf71c50824f7acb2805f2cfe7bb8c06c74c33b8","target":{"file":"src/mongo/bson/bson_validate.cpp","function":"_doValidateColumn"}},{"deprecated":false,"digest":{"function_hash":"151311517198099843615574626630311038376","length":206},"id":"CVE-2026-18696-eccd342c","signature_type":"Function","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/1cf71c50824f7acb2805f2cfe7bb8c06c74c33b8","target":{"file":"src/mongo/bson/bson_validate_test.cpp","function":"createColumnObj"}},{"target":{"file":"src/mongo/bson/bson_validate_test.cpp"},"deprecated":false,"digest":{"line_hashes":["193592950059713353269412950912232375802","13884163038216494173285896997696661771","17779248285596067815159733101639687819","211201462012502232220545830622151134171","173261275953923490606268709575819418054","189270793674390707448992320910736784097","177033174486218015255111720354200409536","141294996217964458183374843046289238613","134856389308146850814043737186700274288","270905333313063229780056256230477999157","115142946852211164029990729764734838047","39913569523959233710781008539501685348","281080647386568916830254069034617080357","108242460815976041288777000013418729186","89943430863331665065216456612012082227","223548152403749342325123141147032876293","20722843402016554535432646161061331732","286443918133312298125125656227954378412","23060997820641780297774157715093731159","233069750605290641958383024139636129790","254898730434426291981492027896813630721","101691134038663587491607942480084048559","67453846958088707675556961537355049911","212549797233732723375184368125501289933","244748423843077713311664720618450320362","1491349156572317009755039371557061729","276128551348504526969364250912212240344","100441625358297696963632172651072582944","46535382660776061041932497291828331057","116546147502672052997453310351240410853","109509812030179432653252763646387591149","224801684267752027232149867197528850066","192149914502928224108557882616690105123","314252463847032373130785992925797023138","92662454618619981787899408236896007467","329879467051940502429945266754290777188","261503534704092342837860419253754101837","121801198310964383837270350334351844676","177597785434708311494744317947765219343","312928010494915622697861635493084831826","186374669923249079106098030390613609156","47457490959684704379867521067034133922","123399142392277061713394784885235623321","94492203835113505328590770547800748602","292382196755877194577641029740425193488","58271530286627841043903016266836126587","130457102936411322455692349925075484719","120218192941265334502803891030617469104","247720734330423004997632178322820984094","4939075023016697009361412906245186906","98184356036796081928080059986970866566","221595556796327329182962934606424558853","162083061241953302840726848464748940013","253072112136080774910143176150076019962","150760528124763694176294508263465640161","228644575039777665240327306739583572806","29453068345772641635722585217735476290","487335701444202830674289065226249402","225059234795667380768184045006760955490","41274118651220889030270673621173555976","269122037066079678044457293727103311800","76257730405259402676707049269585194091","264046230611900122281420683235463287216","69533212116605679583718423045668185845","85875739926785718506637795026939230055","295687229100691504494444629320077315577","17224295143420280938174616506178355796","64748780793648384710144268257737187261","75323751303916838001355774654126502935","128498096142497293375432253199275166469","244458250226088152680197059694235710999","314690996235197435410300987667782298574","269122037066079678044457293727103311800","169202530530934864451861004195705120415","218106198106140939591489080019878019574","170921685530752086187931704640142090021","124672386310681916027263700125948719602","35614369625373959384119352800376208266","164027473347420305076581657406515314825","310436240515049859675907511629541626085","242249920773147004788896623684354711680","77536063225648350531551024649379753414","125547296691696181779294940009969498461","183015232106754729318678129794755653596","6023952281002450137985084740449849110","243167343559419229758223320186838208662","303700938199691596199172514215336966068","59695807861797881421585833341999862500","319697860664324452367544238272503171411"],"threshold":0.9},"id":"CVE-2026-18696-fbd79c41","signature_type":"Line","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/d100bf19961251f273e1d0bd8ce66fc60634f53c"},{"target":{"file":"src/mongo/bson/bson_validate_test.cpp"},"deprecated":false,"digest":{"line_hashes":["193592950059713353269412950912232375802","13884163038216494173285896997696661771","17779248285596067815159733101639687819","211201462012502232220545830622151134171","173261275953923490606268709575819418054","189270793674390707448992320910736784097","177033174486218015255111720354200409536","141294996217964458183374843046289238613","134856389308146850814043737186700274288","270905333313063229780056256230477999157","115142946852211164029990729764734838047","39913569523959233710781008539501685348","281080647386568916830254069034617080357","72629263284137956806529710948653370950","237908985298527160578457137127150752386","234935697042669943515762964279362384073","212263612740257258350676888775696257667","63072544569963237589155075873412391664","42129624534025633091500174272833234503","254898730434426291981492027896813630721","101691134038663587491607942480084048559","67453846958088707675556961537355049911","212549797233732723375184368125501289933","244748423843077713311664720618450320362","1491349156572317009755039371557061729","276128551348504526969364250912212240344","100441625358297696963632172651072582944","46535382660776061041932497291828331057","116546147502672052997453310351240410853","109509812030179432653252763646387591149","224801684267752027232149867197528850066","192149914502928224108557882616690105123","314252463847032373130785992925797023138","92662454618619981787899408236896007467","329879467051940502429945266754290777188","261503534704092342837860419253754101837","121801198310964383837270350334351844676","177597785434708311494744317947765219343","312928010494915622697861635493084831826","186374669923249079106098030390613609156","47457490959684704379867521067034133922","123399142392277061713394784885235623321","94492203835113505328590770547800748602","292382196755877194577641029740425193488","58271530286627841043903016266836126587","130457102936411322455692349925075484719","120218192941265334502803891030617469104","247720734330423004997632178322820984094","4939075023016697009361412906245186906","339596382549230893849745182202174911424","15461796319207200950459653562211189487","64470588881012856964143618972482977306","286504612661178077999152617286725045826","330310212165930691909891884076992700285","48001007508796235212967952308999275135","203199447286587872313323399729005933318","487335701444202830674289065226249402","225059234795667380768184045006760955490","41274118651220889030270673621173555976","269122037066079678044457293727103311800","76257730405259402676707049269585194091","264046230611900122281420683235463287216","69533212116605679583718423045668185845","85875739926785718506637795026939230055","295687229100691504494444629320077315577","17224295143420280938174616506178355796","64748780793648384710144268257737187261","75323751303916838001355774654126502935","128498096142497293375432253199275166469","244458250226088152680197059694235710999","314690996235197435410300987667782298574","269122037066079678044457293727103311800","169202530530934864451861004195705120415","218106198106140939591489080019878019574","170921685530752086187931704640142090021","124672386310681916027263700125948719602","35614369625373959384119352800376208266","164027473347420305076581657406515314825","310436240515049859675907511629541626085","242249920773147004788896623684354711680","77536063225648350531551024649379753414","125547296691696181779294940009969498461","183015232106754729318678129794755653596","6023952281002450137985084740449849110","243167343559419229758223320186838208662","303700938199691596199172514215336966068","59695807861797881421585833341999862500"],"threshold":0.9},"id":"CVE-2026-18696-fd26d255","signature_type":"Line","signature_version":"v1","source":"https://github.com/mongodb/mongo/commit/1cf71c50824f7acb2805f2cfe7bb8c06c74c33b8"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}]}