CVE-2026-82066 is a medium severity (CVSS 4.3) heap out-of-bounds read in the MongoDB Server query planner. An authenticated user with read and write privileges can trigger it and may see memory contents in diagnostic output. The Jira ticket lists fixes in 7.0.41, 8.0.30, 8.2.13 and 8.3.9.
What's affected
The record describes a heap out-of-bounds read in the query planning component of MongoDB Server. The user needs a login with read and write privileges on a database. Crafted query operations make the server read beyond an allocated buffer, and the record says the revealed memory may be partly visible through diagnostic query statistics output.
The linked Jira ticket, SERVER-131562, is closed as fixed. It lists these fix versions: 7.0.41, 8.0.30, 8.2.13 and 8.3.9, plus release candidates of 9.0 and 9.1. The record itself does not list versions, so the ticket is the source for them. The ticket title describes mis-indexed tie-break vectors in the query multi-planner, which is the multi-plan selection stage of the planner.
Severity note: the record scores it 4.3 (Medium) and I found no second score to compare. Medium here reflects the need for credentials, the limited visibility of the leaked data and the lack of write or availability impact.
How to check if you're exposed
Check the server version from a shell or from mongosh:
mongod --version
db.version()
If your version is below the fixed release for your line, upgrade. The lines named in the ticket are 7.0, 8.0, 8.2 and 8.3. Managed services such as a hosted MongoDB cluster handle upgrades on their own schedule, so check the provider's status or maintenance notes for the patch level.
Also list who holds read and write roles. The weakness needs one such account, so the people and services holding those roles define your exposure. Application service accounts are the usual candidates.
What to do now
- Upgrade each MongoDB deployment to the fixed release for its line, listed in the SERVER-131562 ticket.
- If you use a managed service, confirm the provider has applied a fixed version and note the date.
- Review database users with read and write access. Remove accounts that are no longer in use and scope the others to the databases they need.
- Restrict who can see diagnostic and query statistics output, because the record points to it as the place leaked bytes may show up.
- Keep the database off public networks and require authentication on every instance.
Why it matters
A heap out-of-bounds read, tracked as CWE-125, lets code read memory next to the buffer it should be reading. What is next to it is not predictable. It may be empty space, or it may be pieces of other queries or data held by the process. The record says the exposure appears through diagnostic statistics, which limits how an attacker sees it.
It is a medium issue because it needs an authenticated account and gives a small, uncontrolled view of memory. It is still worth patching on a normal schedule, since database processes hold sensitive data and credentials for many users. The record does not list this CVE as exploited in the wild.
Quick check
Can an unauthenticated user reach this?
Not per the record. It needs an authenticated user with read and write privileges.
Where do I find the fixed version?
In the SERVER-131562 Jira ticket's fix version list, which names 7.0.41, 8.0.30, 8.2.13 and 8.3.9 among others.
Sources
Last reviewed: 18 October 2026.
