CVE-2026-9754: Stack memory disclosure in filemd5 command

Synopsis

This is a stack memory disclosure vulnerability in MongoDB affecting versions 8.2.0 through 8.2.9 and 8.3.0 through 8.3.2. It is reachable over the network by any authenticated user holding the read role, with no elevated privileges required. Successful exploitation lets the attacker read small amounts of uninitialized stack memory, potentially exposing sensitive in-process data such as credentials, keys, or other secrets that happen to be resident in that memory region. Patched-image rebuilds at versions 8.2.10 and 8.3.3 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MongoDB service over the network to issue the filemd5 command.

• AuthenticationRequired

  A valid account with at least the read role is needed; no admin or elevated privileges are required beyond that low-privilege grant.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker sends the crafted command directly.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental prerequisites.

Blast Radius

• The attacker reads small amounts of raw, uninitialized stack memory from the MongoDB server process.
• That memory region may contain fragments of in-process data such as authentication tokens, encryption keys, connection strings, or query results from other users.
• Confidentiality of data held in memory is compromised; no writes, deletes, or service disruption are introduced by this vulnerability.
• The scope is limited to the affected MongoDB process; no cross-system (scope-changed) impact is indicated by the CVSS vector.